docs: record adoption audit and plan v0.4 release

[tanka420]

Product problem and why now

The merged post-C12 package behaves differently from the currently published npm and exact Action v0.3.0 release. A02 also needed to decide whether the pinned adoption corpus justified another analyzer milestone.

Decision and risk

• A02: No-Build. Eight pinned repositories and 545 discovered files produced 100/pass/0 default findings; no C13 analyzer expansion is authorized.
• A03: correct the published-vs-main documentation boundary without mutating package, Action, tag, or registry state.
• R01: R3 staged v0.4.0 release plan. E1 npm package, E2A Action candidate, E2B exact-SHA pre-tag proof, E3A tagged smoke, then E3B closeout.

Scope

Documentation only: README, A02/A03 research, approved R01 plan, roadmap/backlog, and npm publishing records. No package version, runtime, rule, severity, preset, schema, score, exit, dependency, Action execution, npm tag, or Git tag change.

Evidence

• npm latest: 0.3.0; 0.4.0 absent at review time.
• Published pack: 7 entries, 18,109-byte tarball.
• Current built pack: 10 entries, 91,643-byte tarball.
• Prettier and diff checks passed.
• Final independent architecture review: APPROVE, 0 blocker / 0 major / 0 minor.
• Reviewed staged patch SHA-256: f4a79d76a1f79fed0d5f8318a5f48ae0029024d65efb415b9e0d8e12b866a848.

Boundaries

E1 implementation has not started. This PR does not authorize npm publish, Action default mutation, tag creation, GitHub Release creation, or analyzer expansion. Those remain separately gated by R01.