v0.14.1

Repair the publish pipeline: allowlist the public OAuth client ID so the release secret scan stops blocking binary builds.

Context

The 0.14.0 scaffold update added a gitleaks dir . source scan to the publish
workflow. It flagged internal/oauth/oauth.go's OAuthClientID -- Claude Code's
public OAuth client identifier, which is not a credential -- as a
generic-api-key, so goreleaser never ran and the v0.14.0 GitHub Release
shipped without its binary archives.

This release adds a .gitleaks.toml allowlist for that one public identifier
and re-runs the publish pipeline, restoring the pre-built binaries. It carries
no user-facing code changes, hence bump = "infra".

Infrastructure

• Repair the publish pipeline: allowlist the public OAuth client ID so the release secret scan stops blocking binary builds.