chore(release): prepare v0.14.7

[steipete]

Summary

• date the v0.14.7 changelog section after the SQLite recovery fix and CodeQL refresh landed

Verification

• make check — tidy, format, vet, dead-code, vulnerability, ordinary, and race suites passed
• actionlint .github/workflows/*.yml passed
• Codex release-freeze autoreview was clean with no accepted/actionable findings

Blocker

Do not dispatch the unified release workflow yet. Its OpenClaw Developer ID signing secrets are unavailable; this PR only prepares the source and does not create a local tag or substitute release.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(release): prepare v0.14.7 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Landed as e3e8b09.

Verification:

• make check and actionlint passed
• exact-head Linux/Windows CI, CodeQL, and secret scans passed
• Codex release-freeze autoreview was clean with no accepted/actionable findings

Release remains intentionally blocked: the unified workflow requires unavailable OpenClaw macOS signing secrets. No tag was created and the workflow was not dispatched.