chore(release): bump version to 0.1.4

[robinnsc]

What

Bumps the workspace version from 0.1.3 to 0.1.4 (one line in the root
Cargo.toml), refreshes the workspace-member entries in Cargo.lock, and
regenerates SOFTWARE-LICENSE-NOTICES.html for the crate version strings.
No dependency or source change.

Why

v0.1.3 is already tagged and published as a GitHub release (2026-08-10),
pointing at 3961c63a — a commit that predates the dependency advisory
remediation in #254 (RUSTSEC-2026-0204). The first public container image
must ship the fixed dependency graph, so its release commit cannot be the one
v0.1.3 names.

Release tags and published releases are immutable: moving or deleting
v0.1.3 would rewrite something public since Aug 10. The clean path is the
next patch version. This also satisfies the release workflow's version gate
(#251), which requires the release tag to match the workspace version at the
tagged commit.

After this merges, the release flow is: tag v0.1.4 on the merged commit,
dispatch the release workflow for the Docker Hub candidate, then the manual
mirror/sign/promote steps per the release runbook.

Testing done

• cargo check --workspace --all-targets --locked — clean.
• Verified the Cargo.lock diff touches only the twelve extenddb-*
  workspace crates (version 0.1.3 → 0.1.4); no third-party entries moved.
• Verified the SOFTWARE-LICENSE-NOTICES.html diff contains only
  extenddb* 0.1.3 → 0.1.4 version strings;
  devtools/generate-software-license-notices --check passes.

Checklist

• All tests pass (cargo test --workspace) — not re-run: no source or
  dependency change; the identical code was fully tested in fix(deps): remediate Rust advisories and drop deprecated rustls-pemfile #254
• Code is formatted (cargo fmt --check) — not applicable, no Rust source changed
• Clippy is clean (cargo clippy -- -W clippy::pedantic) — not applicable, no Rust source changed
• I have added or updated tests for new functionality — not applicable
• I have updated documentation if behavior changed — not applicable
• Breaking changes are noted below (if any)
• If this changes the wire protocol, Storage trait, auth model, on-disk
  format, or public CLI surface, an RFC has been accepted or is linked
  below. Otherwise, an ADR captures the decision (link below).

ADR / RFC: n/a — version metadata only.

Breaking changes

None.

---

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache License 2.0 and I agree to the Developer Certificate of
Origin (DCO). See CONTRIBUTING.md for details.

[jcshepherd]

LGTM