v0.14.2

Added

• The JavaScript SDK now publishes to npm from CI via Trusted Publishing (OIDC) on a js-sdk-v* tag — no npm token exists anywhere, and every release carries build provenance. First release through it: @rmyndharis/openwa@0.2.0, carrying everything added since 0.1.0 in June.
• The Python SDK now publishes to PyPI from CI via Trusted Publishing (OIDC) on a py-sdk-v* tag — no PyPI token exists anywhere, matching the JavaScript SDK's release path.
• The PHP SDK now cuts versioned releases from CI on a php-sdk-v* tag — it tags the Packagist mirror, which previously only ever tracked dev-main because nothing propagated a version.
• The Go SDK documents how it is released — tags must carry the sdk/go/ module prefix, so a bare v* app tag never publishes it and callers can finally pin a version instead of a pseudo-version.

Fixed

• The Java SDK release guide described the opposite of what the workflow does — it promised a missing publish secret makes the run a harmless no-op, while the guard has since been a hard failure by design.
• A whatsapp-web.js session failing with Execution context was destroyed showed a bare Puppeteer error with no next step — the advisory naming the likely stale browser profile went only to the server log, so the session card now carries a short form of it too.
• Infrastructure reported "Pinned by an environment variable" for any unapplied change, without naming the variable — the gateway now reports which settings a higher-precedence layer actually supplies, so a real pin names its variable, a saved-but-not-restarted change says so instead, and the Engine card gained the notice it never had.