chore: release v0.14.0

[LKSNDRTMLKV]

Release preparation for 0.14.0. No behaviour change — version bump, changelog entries for work that merged without them, and a structural fix to [Unreleased].

The three version sites move together

Cargo.toml · api/openapi.yaml · both committed bundles. One line each, which is the footprint a clean redocly bundle leaves. spec-version-check compares the first two; only openapi-check re-bundles and diffs the artifacts, and it is not in just check because it needs Node — so it was run separately and is green on the committed tree.

Four changelog entries that were missing

#365, #367, #368 and #369 merged without one. Two of them are user-visible and would otherwise have shipped unannounced: a new 422 on POST /dpp and PUT /dpp/{dppId}, and a new Content-Location response header. #364, #366 and #370 are genuinely internal and get none.

[Unreleased] had five section headings

Breaking, Fixed, Added, then a second Fixed and Added — someone appended a block rather than merging into the existing sections. RELEASE.md item 7 asks for exactly this reconciliation.

Conservation was proved rather than assumed, because git diff --numstat reports 183 deletions and that looks alarming until you see they are a block changing position:

• per-section bullets afterwards: Breaking 4, Fixed 10, Added 49 = 63 = 59 preserved + 4 new;
• whole file 233 → 237, exactly +4;
• a set comparison of every bullet headline before and after: nothing present before is missing after.

Pre-release checklist — all nine verified

item	result
1 CI green	just check exit 0 — 1282 unit tests
2 Integration	842 tests across four Docker tiers, 0 failures
3 CHANGELOG	this PR
4 Migrations	0038–0040 added since v0.13.0, zero modified
5 Bootstrap	odal bootstrap provisions the operator and mints a working admin key against a fresh node
6 README	crate map, core table and resolver routes all match the source
7 Sections	reconciled, above
8 cargo audit	827 deps; bans, licenses, sources ok
9 Core pinned	0.20.0, a published release

Not in this release

archive→retire is not here. That rename is core's and arrives with the 0.21.0 repin (#358), so it lands in 0.15.0 — this release still pins core 0.20.0.

Owed after the tag

v0.13.0 has no GitHub Release and no binary: release.yml publishes the two container images on a v* tag and nothing else, and steps 5–6 of RELEASE.md are manual. That is now a two-release gap and should be closed for 0.14.0 rather than repeated.