merge: incorporate origin/main into community-mode branch

Conflicts resolved:
- VERSION: keep 0.14.0.0 (our branch > main's 0.13.1.0)
- CHANGELOG.md: keep both entries, 0.14.0.0 above 0.13.1.0

Main brought in v0.13.1.0 "Defense in Depth": auth token via file
instead of /health endpoint, Bearer auth on cookie picker data routes,
CORS tightened, state file expiry, textContent over innerHTML in
extension, symlink-aware path validation, portable freeze hook,
shell config input sanitization. 20 regression tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -7,6 +7,7 @@ bin/gstack-global-discover
 .claude/skills/
 .agents/
 .context/
+extension/.auth.json
 .gstack-worktrees/
 /tmp/
 *.log