chore(release): cut v0.14.0

[haribo]

Summary

v0.14.0 — one addition and nine fixes. Minor rather than patch: status accepts four inputs it
refused, which is a surface a user can see.

Added

• A test asserting every CLI flag appears in README.md, walking the commands' own flag sets.

Fixed — the highlights

• A def call missing a required argument is refused instead of binding it to the empty string:
  file.write(path) overwrote a file with nothing under ok.done.
• htpasswd.entry and system.timezone observe everything their apply sets — the third
  recurrence of that class, closed with two adverse cases seen red on a real machine.
• Three dropped failures in the agent and local transport, including a descriptor leaked per
  run for the agent's whole life.
• status takes --vars, --set, -v and --agent-ttl, from the same definition run uses.
• internal/report no longer calls os.Exit, which its own comment said it never did.
• The README stops teaching the observe that cost report a purged package as absent in apt.install #486, and its install snippet fetches the
  latest release instead of one three versions old.

Full notes in CHANGELOG.md under [0.14.0]; CI publishes them from the tag.

Closes #633
Closes #635
Closes #636
Closes #637
Closes #638
Closes #639
Closes #640
Closes #641
Closes #642
Closes #646
Closes #647

_{#486 appears in the changelog section as a citation — the defect the README used to teach — not as an issue this version closes. #634, the epic behind #635/#636, was closed with its sub-issues.}