chore(release): v2.14.0

[CybotTM]

Release v2.14.0

Minor release. .claude-plugin/plugin.json and skills/github-project/SKILL.md frontmatter metadata.version were already synced to 2.14.0 on main via #74 — this PR is the empty release marker that closes the v2.13.1 → v2.14.0 window and triggers the signed-tag release.

Highlights since v2.13.1

• agentic-workflows reference documenting gh-aw and awf workflow-as-prompt tooling for autonomous GitHub Actions — new patterns for running AI agents on PRs/issues without bespoke wiring (#75).
• AI reviewer pushback patterns — handling Copilot/Sourcery review comments that disagree with the codebase intent, including when to defer and when to push back (#66, #74).
• PR-merge / branch-protection / CodeQL gotchas documented, plus auto-detection of allowed merge strategy in the --delete-branch snippet so the recipe doesn't break on repos with merge-commit-only policies (#69, #71, #72).
• GraphQL Repository.mergeQueue for queue detection — replaces a brittle REST probe (#70).
• Assessment checkpoints overhaul: new feat: add GraphQL --input pattern for special characters #34/Add GitHub Actions upgrade guide with breaking changes reference #35/feat: add fork workflow pattern and archived actions docs #36, follow_uses delegation for CodeQL/Scorecard, org_provides for community-health files, broader licence/Dependabot/workflow targets, plus reusable-workflow-pitfalls reference. Multiple false-positive findings demoted to info to reduce assessment noise (#56, #57, #58, #59, #60, #61, #62, #63, #64, #65, #73).
• npm distribution — the skill now also ships via @netresearch/agent-skill-coordinator (#54, #55).
• Release pipeline hardening — dropped the deprecated with: bump: block + workflow_dispatch.bump input so releases happen exclusively via locally-signed tags, plus SLSA-provenance permissions on the caller (#52, #53).

Release plan

After merge: tag main with a signed annotated tag, push, the skill-repo-skill reusable workflow publishes archives + SHA256SUMS with cosign + SLSA attestation, then narrative notes get applied via gh release edit ... --notes-file.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None