fix(javascript): accept the Wakaru 1.x release line and verify 1.14.0 (#1540)

* fix(javascript): accept the Wakaru 1.x release line and verify 1.14.0

Exact --version equality rejected every Wakaru build except 1.13.0, and
strict report schemas rejected any added field, so each upstream release
broke recovery until REA re-pinned. Wakaru now documents that --version,
--json and provenance.json change only by addition within a major version.

Admit ^1.13.0 with the verified/compatible split used for Binwalk and
Unblob, report the observed version instead of the pinned constant, and
add a limitation for unverified releases. Parse reports with loose
objects and keep the reported module status as a string; path, identity,
range and file-set checks stay exact.

Move the audited pin, submodule, CI binary and verifier to 1.14.0, and
document where to get the binary from the refusal message.

* fix(javascript): project known Wakaru warning fields

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

scripts/verify/javascript/recovery.mjs

@@ -15,10 +15,10 @@ import { buildRecoveryFixtures } from "../../fixtures/javascript-recovery/build.
 import { mcpTextValue } from "../../lib/mcp-verifier-results.mjs";
 
 const OFFICIAL_BINARY_SHA256 =
-  "e8c7ca052974604197389f6ace7464e4dd24dce64e2730971521bd6606ec9c9e";
+  "664fa06782a61eda7ed15885134b52525fd565dd77607e642062ceb6cd927c38";
 if (!process.env.REA_WAKARU_COMMAND)
   throw new Error(
-    "Provide REA_WAKARU_COMMAND for the official Wakaru 1.13.0 Linux x64 binary",
+    "Provide REA_WAKARU_COMMAND for the official Wakaru 1.14.0 Linux x64 binary",
   );
 const entrypoint =
   process.argv[2] ?? fileURLToPath(new URL("../../rea.mjs", import.meta.url));
@@ -130,7 +130,7 @@ try {
     }
   }
   finalReport = {
-    engine: "wakaru 1.13.0",
+    engine: "wakaru 1.14.0",
     toolchains: fixtures.toolchains,
     results: counts,
     verified: true,