release: track lockstep 0.4.0 publish/readback for ordvec and ordvec-manifest

[Fieldnote-Echo]

Context

ordvec and ordvec-manifest are both versioned as 0.4.0 locally. OrdinalDB should build against the published 0.4.0 crates rather than duplicating manifest or index-format logic. As of the OrdinalDB integration audit, crates.io still had ordvec newest at 0.3.0, and ordvec-manifest was not published.

This issue tracks the execution gate for the paired Rust publish/readback so downstreams can depend on the soon-to-be 0.4.0 versions cleanly.

Related: #135 covers package metadata parity; #143 covers the publishable manifest verifier API. This issue is the concrete 0.4.0 release-readiness checklist.

Evidence

• Root crate is ordvec 0.4.0: Cargo.toml:1-5.
• Manifest crate is ordvec-manifest 0.4.0 and depends on ordvec = "0.4.0": ordvec-manifest/Cargo.toml:1-31.
• Release docs require lockstep Rust publish and readback checks: RELEASING.md:63-70.
• Release docs require current main and gated CI before tagging/publishing: RELEASING.md:152-180.

Acceptance Criteria

• Current release SHA is on main and required CI is green.
• ordvec 0.4.0 is packaged and published first.
• ordvec-manifest 0.4.0 is packaged and published after ordvec 0.4.0 is available from crates.io.
• Post-publish crates.io readback byte-identity checks pass for both crates.
• docs.rs pages resolve for both crates.
• Downstream smoke crate can depend on:

ordvec = "0.4.0"
ordvec-manifest = "0.4.0"

and compile a minimal RankQuant + verify_for_load example.

• Release notes state that ordvec-manifest is the verifier layer downstreams should reuse rather than reimplement.

Non-goals

• No PyPI release tracking here unless needed for the overall release train.
• No OrdinalDB release work in this issue.
• No API expansion beyond release/readback gating.