Sidecat v0.4.0

Source-only core package-authoring ergonomics minor milestone.

This release closes the first core-authoring ergonomics boundary: standard Starlark tool-run and observed result envelopes, fixture recording through sidecat package test --record, a thinner git-workbench user package, a non-git go-toolchain proof package, and guardrails keeping sidecat.* core packages general rather than app-specific.

It carries forward the v0.3.1 AAuth protected git-push proof and remains early public R&D. It is not recommended for use and is not a production runtime, stable command surface, stable package API, hosted service, official binary package, signed binary artifact, SBOM-backed distribution, or provenance-backed binary release.

Main CI for commit a55b0750cb3464a42f338d0cdf4c93067f1d0118 passed in pipeline 2621979742.