build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 - #102

…for forks (#175)

Installs the five templates of pineforge-workflow's codegen docs-only gate
(workflow #102, with the guard and review fixes of workflow #106 at
8cbd5c6), byte for byte:

  campaign/ci/codegen-gate.yml       -> .github/workflows/gate.yml
  campaign/ci/codegen-test.yml       -> .github/workflows/test.yml
  campaign/ci/codegen-docs-check.mjs -> .github/pineforge/ci/codegen-docs-check.mjs
  campaign/src/codegen-docs-rule.mjs -> .github/pineforge/src/codegen-docs-rule.mjs
  campaign/ci/promote-baseline.yml   -> .github/workflows/promote-baseline.yml

gate.yml runs on pull_request_target from main's definition: a classifier
reads the PR head as data and runs only main's checker, an accepted
documentation/legal-only diff skips the Pyodide differential gate and the
pytest matrix, and a reporter that checks out nothing posts the required
`gate` commit status on the exact head. The root README.md and LICENSE,
which the build reads, count as documentation only as edits. test.yml runs
on pushes to main only, once per commit, and skips a docs-only push.
promote-baseline.yml reads the `gate` status and judges each check-run
name by its newest run; its actions are pinned to full commit SHAs and its
campaign-tooling checkout keeps no credentials. Every job is capped (10
minutes for the classifiers and the reporter, 30 for the heavy jobs).

This repository is public and takes fork pull requests, so `differential`
and `pytest`, the two jobs that run the PR head's code, run only when the
event is not pull_request_target or
github.event.pull_request.head.repo.full_name == github.repository. The
reporter clears the full gate only for a same-repository head. A fork's PR
that does not pass gets a failing `gate` whose description says a
maintainer must push the branch here and open a PR from it; when a run of
this repository already posted a `gate` success on the same commit, the
fork's run leaves it and exits 0 instead of turning that PR red. A fork's
docs-only proof runs no fork code and clears as a same-repository one
does. Nightly and manual runs stay full.

Dependabot groups its GitHub Actions bumps into one monthly PR: the
workflows are the templates', so every bump also goes to pineforge-workflow
and needs a measured pr-gate here. CONTRIBUTING.md says how CI treats pull
requests from forks.

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>