fix: keep import-batch running after token failures
feat: emit release drill record drafts
fix: normalize Debian payload modes
fix: keep Debian publish token out of curl argv
scripts/publish-deb.sh — keep the release token out of curl's argv, the contract publish-release.sh already keeps one step later
fix: report unauthenticated auth state honestly
src/cli.js — stoke auth tells the truth about a token it cannot revoke, and exits non-zero when there is no session
docs: correct release token scope contract
fix: clarify publish-deb auth failure
scripts/publish-deb.sh — report the CI cause when the token is empty, not laptop advice, and cover it with a test
chore: release stoke 1.5.0