ci: setup-docker-builder 2.1.0, gh-action-pypi-publish 1.14.2

Both are exact pins, so dependabot proposes nothing and they only move by
hand. Release notes read rather than assumed: docker-builder 2.1.0 adds
agent-address discovery and a sticky-disk mount fix with no new required
inputs (a major is where that risk lives); pypi-publish 1.14.2 is a
dependency refresh that takes Twine 7 internally, enabling uploads carrying
core packaging metadata 2.5.

Every other action in the workspace was checked the same way and is current:
trivy-action 0.36.0, setup-uv 9.0.0, cosign-installer 4.1.2, setup-atlas 0.3,
claude-code-action 1.0.183, checkov-action 12.3114.0, and the floating majors
which are current by definition. Version pins passed as workflow INPUTS,
which dependabot never sees, are also current: osv-scanner 2.4.0, node 24,
python 3.13.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vvillait88

.github/workflows/publish.yml

@@ -27,7 +27,7 @@ jobs:
       - run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.1
+        uses: pypa/gh-action-pypi-publish@v1.14.2
 
       - name: Create GitHub Release
         run: gh release create "$GITHUB_REF_NAME" --generate-notes