v4.0.0: honest CI baseline Validated against basef + carmine via SHA-pinned MRs (2b048d7f). Both consumer pipelines GREEN before tag. Removed: - verify-downstream (broken Tier 4 trigger pattern since v3.1.0) - pyinfra-smoke, bootc-boot-smoke (never wired) - pipeline-source rule branches added in v3.3.1 Changed: - workflow.auto_cancel.on_new_commit: interruptible Migration: bump consumer pin to v4.0.0. Drop pipeline-source workflow rule from consumers (was only needed for verify-downstream). This is the foundation. v4.1.0 wires the substrate-instance cascade (basef -> carmine trigger + CVE-watch + AI triage).