chore(release): 1.5.2

[ifahimreza]

Release 1.5.2, on Fahim's "fix major release issue what best fit and release 1.5.2".

Merge #360 first, then this. This branch contains #360's two commits, so its diff shrinks to the release commit once #360 is in. Both with merge commits.

What

• Version 1.5.2 in all five places: plugin header, SADDLE_VERSION, readme Stable tag, package.json, package-lock.json (grunt version --to=1.5.2).
• Changelog: a line for the magenta brand (feat(admin): the brand is Saddle magenta (#345) #346), which had none. Every other 1.5.2 line was written with its change, and the update-core line now says majors need Saddle's own setting (update-core: major releases need Saddle's own setting, off by default #359).
• languages/saddle.pot regenerated: version header and update-core: major releases need Saddle's own setting, off by default #359's strings.
• Tested up to stays 7.1 (Fahim's call; this release was tested on 7.0.7 and 7.1.3).

What 1.5.2 carries

#334 ask before confirming · #339 Bridle and Bridle KB first-party · #342 runs beside the MCP adapter 0.7.0 · #346 magenta brand · #353-#358 installs from WordPress.org, update-core, update-translations · #360 major releases behind Saddle's own switch.

Testing

• CI green on main 4b1db33 and on fix(updates): major WordPress releases need Saddle's own setting (#359) #360
• PHPUnit 1512 tests, 1 skip that was already there (PHP 8.2); phpcs 0 errors; JS 342/342; lint:js clean
• npm run build reproduces the committed admin/build byte for byte (node 26)
• npx grunt build: saddle-1.5.2.zip, 327 files. No updater, no class-saddle-ecosystem.php, no includes/lib, no tests, no .md; 1.5.2 in the header, the constant and Stable tag; the exec-family grep has only prose hits
• Plugin Check by path on the extracted zip: 0 errors, the same 4 known warnings as 1.5.1 (readme name, one adapter hook name, two dynamic hooks)
• Real install, Playground with the built zip, as an MCP client:
  • a fresh install's tier row is read
  • a delete-page preview changed nothing
  • a confirmed delete-post ran once and moved the post to the trash; the reused token was refused
  • a revoked key got 401 saddle_credential_rejected
  • the Saddle key cannot reach the rest of the REST API
• Major releases (update-core: major releases need Saddle's own setting, off by default #359) on that install: see fix(updates): major WordPress releases need Saddle's own setting (#359) #360. A real 7.0.7 → 7.1.3 update was applied after the owner turned the switch on.

After merge

Tag v1.5.2 on main. release.yml checks the versions, builds the zip, publishes the GitHub Release and pushes to WordPress.org SVN.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}