Release v1.15.1 auth wrapper fix

[amariichi]

Summary

• Forward MH_FACE_AUTH_TOKEN through the bound MCP wrapper from the environment, parent process, or MH_FACE_ENV_FILE
• Document the Codex auth-token path without checking in secrets
• Bump repository and worker package versions to 1.15.1

Tests

• npm test
• bash -n scripts/run-bound-mcp-server.sh
• wrapper auth smoke: face_ping ok:true with token loaded from ~/.config/minimum-headroom.env