chore: release v0.4.0

[erwin-wee]

Release 0.3.2 → 0.4.0. Finalizes CHANGELOG.md and bumps package.json and package-lock.json.

Commits shipped:

• fix: audit wave 1 — security hardening, release pipeline, UX and server fixes
• feat: audit wave 2 — AI infrastructure, AI settings, UX/perf and small features
• feat: audit wave 3 — graph, accounts, windows, undo/bisect, stacks, shortcuts, MCP
• fix: start the launch-time watched-folder scan once git is located
• docs: regroup README, add CHANGELOG and SECURITY, archive completed openspec changes
• fix: gate sparse checkout and expose AI commit-message cancellation
• refactor: split renderer actions and core handlers by domain
• fix(ci): enable cross-platform suites and normalize Windows fixture paths
• fix: normalize MCP repository paths and settle diff smoke scrolling
• docs: record cross-platform CI and archive main-process test change
• fix(git): preserve undo boundaries, stack tracking and rename diffs
• fix(ai): isolate concurrent jobs and cancellation by client
• fix(repo): inherit worktree policies and gate updates across clients
• fix(security): decode secret paths and validate shell placeholder scope
• fix(release): upload nested artifact files instead of directories
• fix(shortcuts): confirm reset conflicts before unbinding another action
• docs: record fixes from local branch review
• Merge pull request feat: harden GitGood and expand Git workflows #36 from erwin-wee/fix/audit-all
• chore: release v0.4.0
• docs: finalize v0.4.0 release notes