chore: pin runner digest and release 0.1.4

[ChuTingzj]

Post-merge follow-up for #12 (c09de54).

Summary

• Pin DEFAULT_SANDBOX_IMAGE to the GHCR digest from Publish runner image run 35562517613 (success on c09de54 after sandbox/** changed).
• Digest: ghcr.io/ffp-tech-lab/ffp-sql-sandbox-runner@sha256:d8347adb65417b00d6395a77a2e3a53a2fc15b231ca47dd8646b77416563112c
• Update the README docker pull pin to the same digest.
• Bump package.json version 0.1.3 → 0.1.4 so we can tag v0.1.4 and run Publish npm.

Does not change sandbox/** (no runner republish). Convenience image tags stay :v1 / :0.1.0.

After merge

1. Annotated tag v0.1.4 on the release commit (must match package.json).
2. Push the tag so publish-npm.yml publishes ffp-sql-sandbox@0.1.4. Already-published versions are skipped.

Test plan

• CI: typecheck, test, build
• Confirm digest matches the Publish runner job summary for fix: emit Postgres column meta from result.fields (#11) #12
• After merge, tag v0.1.4 and confirm npm / Publish npm run

  

[cursor]

Approved: Cursor Bugbot completed successfully and reported no findings that need human review. No approval policy required additional review, and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}