Prepare v0.4.0 repository health release

[cfregly]

What this PR does

Prepares the public v0.4.0 release. It adds repository-wide Ruff, Pyright, and ShellCheck gates, makes Codex and Claude the first-class install paths, hardens MCP and CLI trust boundaries, removes stale private-workspace assumptions, and aligns public docs, packaging, release checks, and version metadata.

Scope of change

• New skill(s) added (lists below)
• Existing skill(s) modified
• MCP server added / changed in .mcp.json
• Bundled server contract or tool surface changed
• README / CONTRIBUTING / REVIEWERS / docs only
• Other: quality gates, release automation, dependency pins, installers, and security fixes

New / changed skills

• No skills were added or removed. Existing instructions and assets were updated to use checked-in public workflows, safe path handling, and secret-free AIPerf authentication. The MCP surface remains 53 tools across 8 libraries.

Version bump

Current: 0.3.1 -> Proposed: 0.4.0

Justification: MINOR. This release adds a supported Codex Skills install path, explicit client selection, and new contributor quality gates. It also changes AIPerf authentication and several fail-closed CLI contracts.

Validation checklist

• make all returns PASS.
• Every new or changed skill passes make validate-agent-skills.
• Every new or changed SKILL.md uses only supported frontmatter fields, and allowed-tools is a space-delimited string.
• Long skills move stable reference material into sibling files when that improves discovery and loading.
• No Windows-style paths (\\) in any SKILL.md.
• Source-of-truth docs are cited, not copied into the skill.
• No chat-write tool is referenced.
• Mutating MCP tools enforce their structured acknowledgement fields.
• Root README.md reflects the current skill families and count.
• No new MCP server was added.
• make smoke-test confirms 53 MCP tools across 8 libraries.

Adapter checks

• claude plugin validate --strict plugins/profile-and-optimize passes.
• Changed client installers pass isolated dry-run and idempotency tests.
• No new performance claim requires hardware validation. GPU-dependent workflows remain documented as operator-run checks.

Notes for reviewers

Local validation passed 1,062 tests and 160 subtests, a live 53-tool MCP handshake, all 32 Agent Skills, Pyright with zero errors, Ruff over 304 files, ShellCheck over every tracked shell script, full pre-commit, strict Claude plugin validation, package builds, and 89 Markdown files with zero broken links. Three independent final reviews returned SHIP with no remaining P0, P1, or P2 findings.