v0.2.14

fix: migrate Renovate-updated client token action pins (#86)

Automatic v0.2.13 rollout stopped on eight callers after Renovate updated their client token action to the official v3.3.0 SHA. The migrator only recognized v3.2.0.

Accept the audited v3.2.0 and v3.3.0 pins and generate v3.3.0. Preserve strict action repository, token inputs, step shape, repository scope, and unknown-revision rejection. Document the supported versions and add one regression covering both recognized pins and rejected tag/unknown/other-owner references.

Validation: official v3.3.0 resolves to 64ab729a6294000f5aa4a4bc0b73d1f32bc45510; all six client migration tests pass. CI and candidate scratch generation checks are pending. Package version advances to 0.2.14 for the source-bound publication.

Final candidate: ffeab567da104df201004ad58dfb994a92c63450. Previous-generation validation normalizes only the audited old token pin before comparing canonical workflow content; other field validation is unchanged. The final six related tests pass, including both old/new generations and unknown-action rejection.

Read-only preflight migrated current workflow snapshots from all eight failed callers successfully. Candidate prepare/client-smoke passed in run 38511437925. Scratch PR #117's actual pinact/native-client/status-check jobs passed (runs 38511657487 and 38511657520). Its intentionally unauthorized sensitive change also exercised the normal published v0.2.13 Policy Check: run 38511694306 succeeded while publishing a failure check plus the explanatory PR comment (6160923101), proving the original HTTP 403 fix in the real repository-scoped write-token path. Full candidate CI and exact-head approval passed.