v1.14.0

Declarative registry auth: root config registries: (gcp-wif / ghcr / docker) -> SHA-pinned login steps generated into a managed, drift-checked workflow block by init/sync-workflow, credentials from repo vars/secrets. Completes HANDOFF.md. omarss/frodo-ci@v1 resolves here.