0.1.4

Store-review pass: fixes every blocking finding from the community-store
automated review, plus the lint warnings behind them.

Fixed

• Declared minAppVersion was older than the APIs actually used. The
  manifest claimed 1.5.0 while the plugin calls workspace APIs introduced
  later, so Obsidian could have loaded it into a version that cannot run it.
• Settings headings and styles now use the Obsidian APIs. Section headings
  are Setting.setHeading() rather than raw h3 elements, and the engine log
  pane is styled through a CSS class instead of assigning element.style
  directly, so it follows the user's theme.
• All network calls go through requestUrl. fetch is subject to CORS in
  Obsidian's renderer; both the engine download and the MCP client now use
  Obsidian's exempt transport, injected so tests and any plain Node caller keep
  the fetch default.
• Timers use window.setTimeout for popout-window compatibility, promises are
  no longer left floating, DOM is built with the createEl helpers, and the
  deprecated setWarning button API was replaced.

Added

• Build provenance attestations on main.js, manifest.json and
  styles.css, so a user can cryptographically verify a release was built from
  this repository.
• Release notes are now published with each release.
• ESLint with the official Obsidian plugin ruleset, wired into CI, so
  store-review findings surface before submission rather than after.

Full Changelog: 0.1.3...0.1.4