release: prepare ArcReady 0.4.0 npm package

[tanka420]

Product problem

npm latest and the exact GitHub Action release remain on v0.3.0, while reviewed main contains the cumulative C04-C12 precision, dependency, default-selection, and opt-in JSON v2 work. E1 prepares the bounded npm package candidate without changing the Action release.

Why now and risk

A02 found zero default findings across eight pinned repositories on the post-C12 package, while A03 proved the published v0.3 surfaces cannot reproduce current behavior. This is R3 distribution/external-contract work governed by the approved staged R01 plan.

Architecture decision

Publish in ordered checkpoints: E1 npm package first; E2 updates the Action only after npm availability; later checkpoints prove exact-SHA Action behavior before immutable tag and GitHub Release creation.

Changes

• bump packages/arcready to 0.4.0
• derive the legacy terminal regression version from PACKAGE_VERSION
• add package-boundary, release-note, npm checklist, roadmap, and R01 evidence
• preserve all 70 v0.3 exports and document the sole additive export

Deliberately unchanged

• action.yml default remains 0.3.0
• external tagged smoke remains tanka420/arcready@v0.3.0
• no analyzer, ownership, rule, severity, scoring, schema, reporter, or exit behavior is added by R01
• no npm publish, Git tag, or GitHub Release occurs in this PR

Evidence

• package tests: 42 files / 2,703 tests
• workflow tests: 6/6
• corepack pnpm verify:full: pass
• installed-package smoke: pass, including legacy JSON and opt-in JSON v2
• npm dry-run: 10 entries, 92,141 bytes packed, 436,925 bytes unpacked
• packed API: 70 to 71 exports, zero removals, only arcUsdcAmountConversionRule added
• A02 corpus: 8 pinned clean repositories / 545 files / all score 100, pass, zero findings
• final independent review: APPROVE, 0 blocker / 0 major / 0 minor
• reviewed bundle SHA-256: 0c8825cfe4e79ea83c0e267acafe72fd35911a31f8c85e6c46340bb140217487

Limitations

ArcReady remains local static analysis. JSX/TSX, HTML, imported/cross-file values, rendered UI, generated code, and runtime behavior remain outside the supported boundary unless a specific rule states otherwise. Publication does not certify scanned repositories.