Raise the bngsim floor to 0.15.0, and make CI install what the project declares

[wshlavacek]

PyBNF now requires bngsim 0.15.0.

Why 0.15.0

The reason is a contract rather than a feature PyBNF wants. bngsim 0.15.0 publishes
event_sensitivities as a real capability key. Until it existed PyBNF answered that
question by reading a different key, effective_ic_sensitivity, as a stand-in. That
worked only because the two landed a few commits apart, which is a fact about the order
of commits and not about what either key means.

Guessing wrong is not symmetric. A build without the event fixes does not refuse the case
it cannot handle. It returns a gradient with a term missing, so the fit finishes and
reports a number that looks fine. 0.15.0 is the first release where PyBNF can ask the
real question and get an answer in both directions.

0.15.0 also carries the codegen cache decline reason that PyBNF reads, and a re-vendored
RuleMonkey that declines a TotalRate rule where RuleMonkey and NFsim genuinely disagree
rather than picking one reading.

The drift

The floor is written in six places and two of them had come apart. The continuous
integration action pinned bngsim 0.11.35 while pyproject.toml declared 0.12.2. Both
were set to the same number on 24 July. pyproject.toml moved twice over the following
fortnight and the action never followed, so for three weeks the test runs used a bngsim
older than the project said it required, and nothing said so. Both files carried a
comment asking a person to keep them in sync.

The tests this adds

A comment was all that held it, so there is now a test. The action does not resolve
pyproject.toml. It installs a hand written list that mirrors it, because a job that has
to run without bngsim cannot re-resolve. The new test reads both files and fails when
they name different version ranges for a package, or when the action never installs
something pyproject.toml declares. Both directions fail quietly today. Too low a floor
means the tests pass against a build the published package would reject, and a test
dependency the action leaves out does not fail a job either, because the suite that needs
it skips instead.

A second test covers the same kind of problem in the release itself. The version is
written by hand into four files. pybnf/__init__.py is the source of truth because
pyproject.toml reads it, and CITATION.cff, docs/conf.py and CHANGELOG.md are
separate copies a release has to remember to bump. Nothing was checking them. A stale
CITATION.cff gives anyone citing PyBNF the wrong version, and a stale docs/conf.py
labels the published documentation with the previous release.

Both tests were checked by putting each mistake back one at a time and watching them
fail, rather than only by watching them pass.

The floor also settles a question a third test was leaving open. The warm codegen cache
test accepted either a replayed decline reason or silence, because the old pin allowed
builds on both sides of the change that writes the reason down beside the cached
artifact. 0.15.0 carries it, so the test now asserts the replayed reason word for word.

How this was checked

The whole suite was run against bngsim 0.15.0, including the slow and recovery tiers that
the test jobs skip. 4763 passed, 13 skipped, and one failed.

That one failure is not from this change. 25_island_de recovers the wrong rate, it does
so identically on bngsim 0.13.0 and 0.15.0, and it fails the same way on main without any
of these edits. It is a differential evolution convergence regression from #561 and it is
reported as #648.