Release v3.14.1, and record the release sequence

[amrali-eg]

Two commits: the version bump with its notes, and the release sequence recorded in the
checklist.

Why this is a patch

In the shipped project exactly one file changed behaviour since v3.14.0 —
DirectoryTraversal.cs, where EC-08 replaced the backtracking regex engine. Every other
file under sources/EncodingChecker/ changed by one byte: the byte-order mark the
encoding pass removed.

git diff v3.14.0..master -- sources/EncodingChecker/
20 files changed, 25 insertions(+), 21 deletions(-)

No conversion or detection policy moved, no schema moved, no CLI option moved, and the set
of files any -Include or -Exclude mask selects is unchanged. That also settles the
audit question: the checklist requires a four-corpus run only when detection or conversion
policy changes.

The notes say what is not in it

The release gate becoming deterministic, the smoke suite moving to every pull request, the
source-encoding normalization and the documentation rewrite are all real work, and none of
it reaches EncodingChecker.exe. The notes list them under a heading that says so, rather
than padding the changelog with work a user cannot observe.

They also carry the cost of the one fix — 128 ms against 148 ms over 3,937 files — because
the ledger's earlier claim that it cost nothing was wrong, and a reader weighing the
upgrade should not have to measure it again.

The release sequence

RELEASE-CHECKLIST.md said what to verify and never what to do first. The sequence lived
in whoever ran the last release. It is now twelve numbered steps, each expanded by a
section already in the file, with three points that are not obvious from the gates:

• Decide the version from what changed in the shipped project, not from how much work went
  in. This release is the example.
• Rehearse before tagging. workflow_dispatch on release.yml runs the whole path and
  then stops, because creating the release requires a tag push.
• Write the audit record after the tag, never before — committing it changes the assembly
  through the PDB checksum.

Verification

• Release build 0 warnings; 756 tests; GUI smoke 10/10; backlog checker at
  65 findings — 52 fixed, 9 open
• --version and the built-in help both report 3.14.1
• Release rehearsal run against this branch — build, test, publish, GUI smoke against
  the published executable, package — and it stopped without publishing, as designed.
  Its summary read: "executables not signed, because the certificate secrets are not
  configured", which is the corrected reporting from Clarify defect backlog and release-gate documentation #90 working on a real run

🤖 Generated with Claude Code