v0.14.1

Privacy fix: the published sdist no longer carries the recording machine's paths or private tool inventory.

Context

An audit of the 0.14.0 test infrastructure found that the VCR recorder's
scrubber emptied only list-valued inventory keys. memory_paths arrives from
the CLI as a dict, so it was copied verbatim and a real
/tmp/.../-home--Projects-claudestream/... path shipped inside the
committed cassette -- and inside the published sdist, which packages tests/.
The cassette also carried the recording machine's full tool inventory.

Scrubbing is now type-agnostic (dict, list, str) rather than list-shaped, the
tools inventory is filtered to a public-tool allowlist, and both cassettes were
re-recorded through the credential-less free lane (total_cost_usd 0, zero API
spend). tests/test_cassette_hygiene.py is the backstop that does not need to
know the schema: it greps every committed cassette for home directories, temp
directories, $HOME, the operator username as a path segment and absolute-path
shapes, so the next unknown protocol key cannot leak silently.

The same audit found the spend guard weaker than advertised, all fixed here and
pinned by tests: tests/test_integration.py hardcoded an absolute path to the
real binary (the poisoned PATH only intercepts name lookups, so 19 tests were
outside the guard); the guard hooks lived in tests/conftest.py, so pytest scripts/ ran unguarded; the opt-in assertion checked only a skip count, which a
broken local profile reproduces; and two spend-capable operator scripts in
scripts/ were named test_*.py, so pytest collected them.

Fixes

• Fixed a privacy defect in the published sdist. The 0.14.0 tarball's test cassettes carried the recording machine's filesystem paths and private tool inventory: the recorder scrubbed only list-valued inventory keys, and memory_paths arrives as a dict. Scrubbing is now type-agnostic, the tools inventory is filtered to a public-tool allowlist, both cassettes were re-recorded, and a hygiene test greps every committed cassette for machine-local shapes.