ci: pin gh-action-pypi-publish to v1.14.0 (#64)

Pins the PyPI publish action to a tagged release (\`v1.14.0\`) instead
of the mutable \`release/v1\` branch ref.

Resolves **GHSA-vxmw-7h4f-hqxh** (Low / CVSS 0.0): versions before
1.13.0 expand \`\${{ ... }}\` expressions in contexts that could be
attacker-influenced via crafted branch/tag names. This workflow triggers
on \`push: tags\` (a non-exploitable configuration per the advisory), so
there was no real exposure; this clears the flag and matches the
version-tag pinning style used for the other actions in the repo.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: vvillait88

.github/workflows/publish.yml

@@ -27,7 +27,7 @@ jobs:
       - run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@v1.14.0
 
       - name: Create GitHub Release
         run: gh release create "$GITHUB_REF_NAME" --generate-notes