fix(ci): pin gh-action-pypi-publish to its release commit, not the ta…

…g object

v1.14.2 is an annotated tag; its ref SHA is the tag object, not the
commit the ghcr.io image is built from, so the pinned SHA 404'd.

fix(auth)!: read CREATEOS_API_KEY by default

BREAKING CHANGE: Client no longer reads the previous API key environment variable.

chore(release): bump version to 0.1.1

fix(scripts): resolve the python interpreter from the venv