Bump the publish action past the metadata 2.5 rejection

[jessegrabowski]

The v0.2.0 release build got past the first twine check after #110 and then failed at the upload step for the same reason. gh-action-pypi-publish runs its own twine check inside the publish container, and v1.14.0 pins twine 6, which rejects metadata 2.5. v1.14.2 pins twine 7.

Second commit is unrelated housekeeping, since #110 should have caught this the first time: checkout, cache, setup-python, and codecov-action were each a major behind. All four majors are ESM migrations with no behavior change we're exposed to — nothing here uses pull_request_target, workflow_run, or setup-python's removed pip-install input. Every pinned SHA in the workflows now verifies against the tag its comment claims.

Merging this won't retry the failed v0.2.0 release — that event has already fired. The release needs to be deleted and recreated, or a new tag cut, once this is in.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.52%. Comparing base (1005f37) to head (29050c4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #111   +/-   ##
=======================================
  Coverage   97.52%   97.52%           
=======================================
  Files          61       61           
  Lines        3076     3076           
=======================================
  Hits         3000     3000           
  Misses         76       76           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.