v1.14.8

## Summary

- Fixes cloud chunk uploads blocked by `chunk_id does not match payload content hash`.
- Makes the cloud server authoritative for canonical chunk IDs while preserving payload validation and content-addressed storage.

## Details

- `/sync/push` now accepts valid chunk payloads even when the client-provided `chunk_id` is empty or differs from the server-computed canonical hash.
- The server still canonicalizes and validates the payload before storage.
- Storage and response use the server-computed `chunk_id`, not the client-provided value.
- This prevents client/server canonicalization version skew from blocking `last_acked_seq` and accumulating pending cloud journal entries.

## Validation

- Double adversarial review returned clean.
- `go test -count=1 ./internal/cloud/cloudserver ./internal/cloud/remote ./internal/sync ./internal/store ./internal/mcp ./cmd/engram`
- `git diff --check`