docs: record 0.14.1 in the changelog and point the README at it

[fas89]

The v0.14.1 tag shipped without a changelog entry. Three consequences:

• README.md still advertised v0.14.0 while PyPI serves 0.14.1.
• release.yml generates its release body by extracting the ## [X.Y.Z] — date
  section from CHANGELOG.md; with no [0.14.1] section it fell back to a git
  log, so the v0.14.1 GitHub release notes are raw commit subjects.
• The two HIGH authorisation bypasses fixed in feat(mcp): dual-support the MCP SDK 1.x and 2.x, and close two authz bypasses #492 were not recorded anywhere
  in the changelog, which matters for anyone auditing the security history.

Changes

• CHANGELOG.md — new [0.14.1] — 2026-08-03 section:
  • Security: the two HIGH authz bypasses in the MCP output port (verified and
    self-attested caller attributes were flattened into one dict, so a caller
    could self-attest an uncovered rowFilter — including another tenant's — or
    slip model/useCase past the agentPolicy gate whenever a custom
    FLUID_MCP_JWT_CLAIM_MAPPING omitted them).
  • Changed: MCP SDK 1.x/2.x dual-support via fluid_build/_mcp_compat.py,
    including the twelve camelCase reads that were failing silently under 2.x.
  • Fixed: the legal-entity correction, moved down from [Unreleased].
• CHANGELOG.md — [Unreleased] now holds the release-image grype-ignore
  work, and the [0.14.1] compare link is added.
• README.md — latest-version line v0.14.0 → v0.14.1.

Verification

• PyPI serves 0.14.1 (queried the JSON index directly, not local pip).
• SchemaManager.latest_bundled_version() returns 0.7.5, which is what the
  README already states — 0.7.6 is preview-gated via PREVIEW_VERSIONS, so
  the README needed no schema change.
• Ran release.yml's awk extraction against the edited file: it returns the new
  [0.14.1] body instead of falling back to git log.
• Every version heading has a matching compare link, except 0.8.2 and
  0.8.3rc1 which were already missing before this change and are left alone.

Documentation only — no code, no tests affected.

[github-actions]

📄 Documentation Reminder

This PR appears to be missing a documentation reference. Our docs live in a separate repo.

Please update the PR description with one of:

• Link a docs PR — check the "Docs PR linked" box and paste the URL
• Mark as no docs needed — check "No docs needed" with a justification
• Acknowledge docs TODO — check "Docs TODO" and create the docs PR before merge

See the Contributing Guide for details.