README and CHANGELOG: C2PA Sign 1.5.0 keeps a C2PA 2.x file's origin

Problem/Motivation

The README and the 1.0.0-alpha1 known issues say that C2PA Sign 1.4.11 works only with c2patool 0.9.x, and that c2patool 0.9.x loses the origin of a source file in the current C2PA 2.x format. C2PA Sign 1.5.0 (released 2026-10-20) requires jrglasgow/c2patool 0.6.0 and works with current c2patool releases.

Measured on a fresh site (Drupal 11.4.10, this module on 1.0.x, C2PA Sign 1.5.0 and jrglasgow/c2patool 0.6.0 from Composer, nothing patched), with c2patool 0.27.22, 0.28.1 and 0.28.2:

• Every upload is re-signed and reads Valid through upload, publish, edit and re-publish.
• On all three reading routes an AI-generated C2PA 2.x source (JPEG, PNG, WebP, AVIF, and TIFF and SVG off the verifier route) gets the AI generated suggestion from its ingredient, as a C2PA 1.x source does.
• Files with an untrusted, tampered or grafted ingredient get no suggestion.
• The same holds with a site logo set, which C2PA Sign embeds as an icon.

Not measured: c2patool 0.9.x to 0.26 with 1.5.0, and image style derivatives (this module reads the original).

Proposed resolution

• README: replace the paragraph measured on C2PA Sign 1.4.11 with c2patool 0.9.12 by the 1.5.0 measurement, and say to use C2PA Sign 1.5.0 or later.
• CHANGELOG: a Changed entry under Unreleased. The 1.0.0-alpha1 known issues stay as they are, since they describe that release.

No code change.