R01 E2A: update Action default to arcready 0.4.0

[tanka420]

Summary

• update the repository Action default to published arcready 0.4.0
• keep the external tagged smoke pinned to v0.3.0 until E2B exact-SHA proof
• align current public examples and release evidence without claiming a v0.4.0 tag

Validation

• independent review: APPROVE (0 blocker / 0 major / 0 minor)
• corepack pnpm verify:full
• package transitive-input diff versus E1: zero
• rebuilt package: all 10 entry hashes and tarball SHA-1 match registry E1

Boundaries

• no analyzer or npm package input changes
• no v0.4.0 tag or GitHub Release created
• E2B exact-E2A-SHA external proof remains separate