chore: release v0.14.0

[avrabe]

Summary

Cuts v0.14.0. One landed PR since v0.13.0:

• feat(provenance): emit component-provenance custom section (#192 / LS-M-6) #194 `feat(provenance): emit component-provenance custom section (emit component-provenance custom section preserving per-function origin (scry DD-002) #192 / LS-M-6)` — closes the cross-repo dependency from `pulseengine/scry`'s DD-002. Every defined function in the fused module gets a JSON back-pointer entry under a new `component-provenance` Wasm custom section. Default on, opt-out via `--no-component-provenance`. 11 new tests (5 unit + 6 integration) + new approved LS-M-6 entry.

Test plan

• `cargo check --workspace` clean on 0.14.0
• All 281 lib + 6 `component_provenance` integration tests pass
• Pre-commit hooks pass
• CI green on this PR
• After merge: tag `v0.14.0` triggers the signed/attested release pipeline (third successful run of the synth-pattern flow)

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

⚠️ 35/37 verified — 2 missing regression tests

	count
Passed (≥1 test, all green)	35
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	2

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-R-13
• LS-M-6

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}