Fix PyPI publishing for Core Metadata 2.5

[ebarti]

Problem

The trusted publisher for v0.5.1 rejected the valid wheel before upload:

InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version

The build job installed current Twine and accepted the Core Metadata 2.5 artifacts, while the publishing job was pinned to pypa/gh-action-pypi-publish v1.14.0 with an older metadata parser. The last successful v0.5.0 wheel used Metadata 2.4, which is why the skew surfaced only now.

Failed release run: https://github.com/ebarti/agent-runtime-kit/actions/runs/33272630840

Fix

• pin build-stage validation to Twine 7.0.0
• update the publisher to the immutable official v1.14.2 commit
• retain the immutable-SHA and trusted-publishing security boundary

The official v1.14.2 release specifically upgrades the action to Twine 7 so it can publish Core Metadata 2.5 artifacts:
https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2

Verification

• exact v0.5.1 wheel and sdist pass twine==7.0.0 check --strict
• workflow YAML parses successfully
• publisher SHA resolves to the official annotated v1.14.2 tag commit
• git diff --check

After merge, the existing immutable v0.5.1 tag can be republished with the workflow's manual tag input; no retagging or artifact mutation is required.