Release v2.4.0

What does this MR do and why?

Cuts v2.4.0. VERSION moves to v2.4.0 and the changelog section is retitled; just sync carries the new version into every .reference.yaml pin and every design bundle URL the templates publish. standards/design/check.sh's illustrative pin is hand-edited, because the sync script's glob covers markup and config but not shell.

The release carries three substantive changes. The pipeline standard's optional: true clause, already merged. The docs chrome's opt-in wide page and disclosure styling. And the mermaid vendoring, which removes the last third-party CDN reference from the repo.

Merge last. The changelog entries describe content that arrives in the two MRs below, so this one lands after both. It touches no file either of them touches, so no rebase is expected.

References

• Vendoring: !121 (merged)
• Gate hardening: !122 (merged)
• The clause this release makes enforceable for consumers: !115 (merged)

Standards affected

standards/design/check.sh changes one comment, the illustrative version pin. No assertion changes. standards/design/SKILL.md's pinned bundle URL moves to v2.4.0 with the rest.

Exemption implications

None added or modified. Consumers enforce the needs: optional: true clause once their own reference_version: reaches v2.4.0; the four consumers whose needs: the clause affects are being fixed first, so the bump is a no-op for them.

Test plan

• just guard, just check (21 standards, 0 failed), just validate (including validate-release-notes: v2.4.0 extracts from CHANGELOG.md and all four refusals refuse), just build && just agent green
• just ship: all gates green at reference v2.4.0 / catalog 6
• standards/pipeline/check.sh run against four consumer repos via just check-one
• Templates not lifted into a consumer: the bumped URLs name design/v2.4.0/, which publishes on the first main pipeline after the tag. Same ordering as every prior release.