Bump Grafana Alloy to v1.14.0 (#292)

## Summary
- Bump alloy-k8s, alloy-ringtail, and alloy-tracing-ringtail image tags from v1.13.1 to v1.14.0
- Mark indri alloy (ansible) as reviewed at v1.14.0 — source rebuild from forge mirror needed
- Add missing alloy-ringtail entry to service-versions.yaml
- Update alloy reference doc

## Breaking changes reviewed
- `loki.secretfilter` options removed — not used in our configs
- OTel Collector upgraded to v0.142.0 — Kafka receiver changes don't affect us
- Exporter queue default changes — our tracing pipeline (Beyla → batch → otlphttp) uses simple config, low risk

## Deployment and Testing
- [ ] Sync alloy-k8s: `argocd app set alloy-k8s --revision bump/alloy-v1.14.0 && argocd app sync alloy-k8s`
- [ ] Sync alloy-ringtail: `argocd app set alloy-ringtail --revision bump/alloy-v1.14.0 --server ringtail-argocd && argocd app sync alloy-ringtail`
- [ ] Sync alloy-tracing-ringtail similarly
- [ ] Verify metrics flowing in Grafana
- [ ] Verify traces flowing to Tempo (ringtail)
- [ ] Rebuild indri alloy from source (`v1.14.0` tag on forge mirror), SCP to indri, restart
- [ ] After merge: reset ArgoCD revisions to main, re-sync

Reviewed-on: #292

ansible/roles/alloy/defaults/main.yml

@@ -13,7 +13,7 @@
 #    git clone ssh://forgejo@forge.ops.eblu.me:2222/mirrors/alloy.git ~/code/3rd/alloy
 #
 # 2. Set up build tools via mise:
-#    cd ~/code/3rd/alloy && mise use go@1.25 node yarn
+#    cd ~/code/3rd/alloy && mise use go@1.25.7 node yarn
 #
 # 3. Build with CGO enabled (default in Makefile):
 #    cd ~/code/3rd/alloy && mise x -- make alloy
@@ -21,7 +21,10 @@
 # 4. Copy binary to indri:
 #    scp ~/code/3rd/alloy/build/alloy indri:~/.local/bin/alloy
 #
-# 5. Run ansible to deploy config and LaunchAgent
+# 5. Ad-hoc codesign on indri (SCP'd binaries get quarantined by macOS):
+#    ssh indri 'codesign --sign - --force ~/.local/bin/alloy'
+#
+# 6. Run ansible to deploy config and LaunchAgent
 
 # Binary and paths
 alloy_binary: /Users/erichblume/.local/bin/alloy