chore: pin runner digest and release 0.1.5

[ChuTingzj]

Post-merge follow-up for #17 (9a3ed89).

Summary

• Pin DEFAULT_SANDBOX_IMAGE to the GHCR digest from Publish runner image run 35570188650 (success on 9a3ed894dd4817291ca975aebd4fba5038102a71 after sandbox/** changed).
• Digest: ghcr.io/ffp-tech-lab/ffp-sql-sandbox-runner@sha256:57767f4e80e9f5c6066eeaf996f3101c7ce4ea2740538c06523eeaaf0b15feb6
• Update the README docker pull pin to the same digest.
• Bump package.json version 0.1.4 → 0.1.5 so we can tag v0.1.5 and run Publish npm.

Does not change sandbox/** (no runner republish). Convenience image tags stay :v1 / :0.1.0.

Does not close #16 (UNION/CTE 400s and live large-result e2e remain follow-up).

After merge

1. Annotated tag v0.1.5 on the release commit (must match package.json).
2. Push the tag so publish-npm.yml publishes ffp-sql-sandbox@0.1.5. Already-published versions are skipped.

Test plan

• CI: typecheck, test, build
• Confirm digest matches the Publish runner job summary for fix: MySQL QUERY_TIMEOUT kill + parseable NDJSON (#15) #17
• After merge, tag v0.1.5 and confirm npm / Publish npm run

  

[cursor]

Approved: Cursor Bugbot completed successfully with no findings that need human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}