Reboot 1.4.0

What's Changed

• Update lockfiles for 1.3.0 by @onelxj in #101
• CI: harden container builds against transient registry and CDN failures by @rjhuijsman in #100
• Add billing exemption to the organizations proto by @rileysdev in #94
• Hosting frontend on Cloudflare skills by @onelxj in #93
• Some cleanup by @onelxj in #102
• Run fork PR CI with pull_request_target behind maintainer approval by @rjhuijsman in #103
• OAuth: deliver identity provider claims to User state via SetClaims by @rjhuijsman in #99
• Cancel superseded Development Containers CI runs per PR by @rjhuijsman in #107
• Fix broken docs link in missing-authorization warning by @atimmer in #97
• Bazel: harden third-party archive fetches against transient download failures by @rjhuijsman in #108
• OAuth: add Ory support, including "reactive" claims by @rjhuijsman in #104
• Make clear TS is alpha by @onelxj in #110
• Docs improvements by @rileysdev in #89
• Rework the app-building skills from measured agent behaviour by @onelxj in #111
• Prepare 1.4.0 for release by @onelxj in #112
• Update lockfiles for 1.4.0 by @onelxj in #113

Full Changelog: 1.3.0...1.4.0