security: add PEP 740 attestations to PyPI publish workflow (#19)

- Pin pypa/gh-action-pypi-publish to SHA (v1.14.0)
- Enable attestations: true for PEP 740 provenance
- Add test job before publish (tests must pass before release)
- Add explicit permissions: { contents: read } at workflow level
- Bump version to 0.1.4
- Document attestation in README

Co-authored-by: Gk <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

feat: add update, --worker, --payload, --on-failure, key regen fix

release: v0.1.3

fix: use release/v1 branch ref for pypi-publish (Docker image needs b…

…ranch ref) (#10)

Co-authored-by: Gk <[email protected]>