macp-runtime-v0.14.1

Fixed

• (server) read evicted sessions from storage in WhatIfReplay and GetSession (#311).
  Since 0.10.0, WhatIfReplay and GetSession answered SESSION_NOT_FOUND for a
  finished session once it had been evicted from memory (older than
  MACP_SESSION_RETENTION_SECS), although its log was still on disk. Both RPCs now
  load an evicted session back from storage. No wire or proto change.
• (deploy) set the playground and token-issuer keys in the self-host compose (#306)

Other

• (deploy) pin auth-service 2.0.0 and playground 0.3.0 (#310)
• (deploy) pin control-plane 0.8.0 and ui-console 0.3.0 (#309)
• read secrets from Doppler (#307)
• (integration) cover 0.14.0 Handoff readiness, FORBIDDEN annotations, 0.13.2 task reassignment code; bump stale 0.10.0 image pins (#304)
• (deploy) Doppler as the source of truth for secrets and config (#305)
• pin macp-conform GHCR image to 0.14.0 (#303)