release: agf v0.14.0

[subinium]

Summary

Prepare AGF 0.14.0 as a correctness, performance, terminal-safety, and agent-coverage release.

• add Prime Agent discovery and exact resume support using the v0.7.2 session contract
• add real Kiro v3 metadata/event parsing and exact --resume-id behavior
• make Codex discovery read-only and hide non-interactive/subagent threads by default
• replace index-based TUI actions with stable (agent, session_id) identities
• harden cache freshness, stale-while-revalidate, cross-process writes, deletion truth, and terminal output
• upgrade SuperLightTUI to 0.22.3 and add Linux ARM64, MSRV, RustSec, and Windows gates

Correctness and safety

• deterministic total ordering with one common timestamp-normalization boundary
• source fingerprints include nanosecond metadata, entry digests, SQLite WAL files, configurable roots, and all scanner inputs
• failed/partial scans preserve stale rows and are not persisted as authoritative empty results
• action/resume/delete targets remain stable while background scans reorder or remove sessions
• exact, bounded deletion with path guards and fail-closed Prime Agent deletion
• stdin/stdout TTY contracts, wrapper exit status preservation, ANSI/control/bidi sanitization, and symlink-safe atomic setup writes

Performance

• CLI reuses validated per-agent cache and pushes agent filters into scan planning
• Codex uses threads.rollout_path instead of opening thousands of rollout files on current schemas
• Cursor indexes store databases once; JSONL readers have bounded per-line allocation; SQLite previews are bounded in SQL
• measured on the audited local store: forced Codex scan 0.10–0.12s at about 22.7MB RSS, versus the 0.13 baseline of 2.54s cold and 0.82–0.99s warm

Verification

Exact frozen source passed:

• cargo fmt --all -- --check
• cargo check --all-targets --all-features --locked
• cargo clippy --all-targets --all-features --locked -- -D warnings
• 163/163 debug tests and 163/163 release tests
• Rust 1.88 MSRV check
• cargo audit with 0 vulnerabilities across 146 dependencies
• release build and cargo package recompile
• CLI JSON/CSV ordering, Codex modes, non-TTY behavior, zsh/bash status preservation, NO_COLOR, and direct PTY TUI teardown

Release follow-up

The Homebrew formula intentionally remains unchanged in this PR because v0.14.0 archive checksums do not exist before the tag workflow runs. After the five release assets are published, a follow-up PR will update the formula to 0.14.0 with four Unix checksums and Linux ARM CPU routing.

Closes #61
Closes #62
Closes #63
Closes #64
Closes #65
Closes #66
Closes #67
Closes #68
Closes #69
Closes #70
Closes #71
Closes #72
Closes #73
Closes #74
Partially addresses #75
Partially addresses #76