release: prepare GraphKeeper 0.4.0

[anusbutt]

Outcome

Prepare GraphKeeper 0.4.0 as the versioned release candidate for the native Windows support already merged through PRs #22-#26.

This release-only change aligns package metadata, the lockfile, CLI version output, changelog history, README upgrade guidance, and explicit version tests. It does not change runtime behavior, graph data, schema, diagnostics, dependencies, or compatibility fallbacks.

Evidence

Test-first failure observed before metadata changes:

• focused CLI/release tests failed only because production still reported 0.3.0.

Passing verification:

• Focused CLI, documentation, and clean packed-install tests: 14 passed, 1 expected Windows symlink skip.
• Clean WSL npm run release:verify: 303 functional/security tests passed; both package E2E tests passed.
• Isolated npm run test:performance: 5 passed within existing budgets.
• Native Windows: npm run typecheck, npm run validator:check, npm ls --all, and packaged CLI --version passed.
• npm registry: 0.4.0 is unused; latest remains 0.3.0; package identity and owner match.
• npm packaging dry-run passed with 73 intended files.
• Inspected tarball reports 0.4.0 and has integrity sha512-OgsnfAasgFbDUGWXKYsUT5HBIPdyJ5SFjohfB2ffbbaHzwWrMiODT1cxdHb1C4AebUzZrtb8Dt3EL41HjndkCg==.

The full prepublish workload and npm packaging simulation passed separately. A combined WSL dry-run exceeded the local command ceiling; required cross-platform PR CI remains the final candidate gate.

Checklist

• Tests cover the release version contract and packed-install path.
• Documentation reflects the changed release version and upgrade path.
• Schema compatibility is unchanged.
• Constitution principles and append-only/evidence guarantees remain satisfied.
• npm run build passes.
• npm run typecheck passes.
• Full functional/security and isolated performance suites pass.
• npm run package:smoke passes and the tarball contains intended assets only.
• Validator and hook implementations are unchanged.
• No secrets, credentials, telemetry, generated archives, or unrelated edits are included.

Compatibility and recovery

Linux, macOS, Windows Git Bash, and native Windows PowerShell remain supported through the already-merged implementation and required CI matrix. The legacy validate.sh/jq fallback remains available for customized or unmigrated repositories. Rollback is installation of the prior verified 0.3.0 release; no repository graph migration is introduced by this version-only change.

Publication and the signed v0.4.0 tag will occur only after this PR merges, the exact merged commit is re-verified, and the registry package is verified.