chore: record OpenWA 0.14.0 as the tested host

[rmyndharis]

What

Records OpenWA 0.14.0 as the tested host for all ten plugins, and fixes two pieces of documentation that had gone stale.

• testedOpenWAVersion → 0.14.0 in every manifest (eight were on 0.12.1, gsheets-logger on 0.8.1, supabase-otp-hook on 0.8.16), with plugins.json and the README badges regenerated.
• version and minOpenWAVersion are untouched, and no download URL changed — the catalog cannot advertise a release that does not exist yet.

No plugin needed a code change.

Why the bump is safe

Verified against core 0.14.0 rather than assumed. Comparing blob hashes between the v0.12.1 and v0.14.0 tags, these are byte-identical: the manifest schema, the net allowlist, activation, the handover gate, webhook-ingress subscription, the hook interfaces, and the entire sandbox worker tree. Every permission string and hook name these plugins declare still exists and is still emitted with the same payload. The manifest schema gained no field, and SUPPORTED_SDK_MAJOR is still 1.

The loader shrank by around 1,100 lines in this window, which looks alarming in a diff stat but is a decomposition into plugin-sandbox-bridge.ts and plugin-capability-context.ts — every capability verb, gate, timeout and error string is preserved.

testedOpenWAVersion is never enforced by the host; it is catalog display metadata. Bumping it is documentation, and that is the point — it tells operators which host these were actually exercised against.

Two behaviour notes

Baileys stopped generating link previews unless the sender asks for it, and the plugin send path has no way to ask — ConversationSendEnvelope has no linkPreview field. Two plugins are affected in a way a user would notice, and both now say so in their README:

• typebot-connector — link and redirect bubbles are sent as a bare URL, so the preview card was the content.
• chatwoot-adapter — an agent reply containing a link arrives as a plain link.

Reply-only plugins (after-hours, chat-flow, faq-bot, http-action) are unaffected, quoted replies keep their preview, and the whatsapp-web.js engine is unaffected entirely. Adding linkPreview to the plugin send envelope is worth a separate request upstream; the REST send DTO already has it.

Also

registerSearchProvider has required the search:provide permission since core 0.12.2 — the host denies the registration outright without it. The vendored contract still told readers it was ungated, which would have sent anyone adding a search backend down a confusing path.

Verification

npx tsc --noEmit clean, 535/535 tests passing, node scripts/catalog.mjs --check reports the catalog up to date.

Worth flagging separately: tsconfig.json compiles against the vendored types/openwa.d.ts, and there is no sync script or drift guard for that file. A green typecheck proves internal consistency, not host compatibility — the compatibility claims above rest on reading core, not on the exit code.