catalog: pin secret-drop 1.4.0

The desktop half is one plugin.js. A sibling locale import is rejected by the Desktop loader, so the composer key never registered.

plugin-catalog/secret-drop.yaml

@@ -1,6 +1,6 @@
 name: secret-drop
 repo: https://github.com/Goitonthefloor/hermes-secret-drop
-sha: 6217414879a880624404fb21a645e9be93ada9cf
+sha: 505bd3b47937ae453d4a54a2ee2455a4d274bf42
 description: 'Store a secret on the gateway host without showing it to the model. Disclosure — stores the value in
   plaintext in the profile .env (mode 0600) and adds the name to terminal.env_passthrough, so $NAME is available to the
   terminal tool; the model can still read the value with its own tools (cat .env, echo $NAME). Keeps secrets out of
@@ -10,7 +10,7 @@ description: 'Store a secret on the gateway host without showing it to the model
 maintainer: Goitonthefloor
 tier: community
 category: desktop
-version: "1.3.0"
+version: "1.4.0"
 capabilities:
   provides_tools: []
   provides_hooks: