release: lockdocs 0.4.0

[shtse8]

Release scope

• Release merged feat: useful release-pinned docs on first use #40: anonymous exact-tag/immutable-commit docs on first use, explicit opt-out/offline controls, honest provenance, safe cache upgrade and transient failure retries.
• Include the previously merged mcp-kit 0.3 adoption and one-click Cursor/VS Code setup improvements.
• Keep measured configurations distinct: package-only hybrid 60/105, actual empty-cache first-use default 70/105, explicit prefetch 96/105. The default score does not beat Context7 77/105; no claim otherwise.

Ownership and validation

• Based on verified feat: useful release-pinned docs on first use #40 merge f0ba122; crates and benchmark sources match reviewed b05aecd.
• Versioned all supported manifests through scripts/set-version.ts; regenerated Cargo.lock with cargo update -w --offline. Only the two workspace versions changed in Cargo.lock.
• Passed version/capability/tagline checks, editor-install verification, three benchmark harness tests and diff checks. No local Rust compilation/tests; full hosted CI verifies the release head.

Landing and published readback

• Lead-owned final architect review and normal queue arming. This PR does not change publisher credentials/workflows or dispatch/tag a release.
• Normal push-to-main release.yml detects npm 0.4.0 as unpublished, builds five native targets, publishes via existing OIDC, then runs published-install smoke and registry/release steps.
• A prepared independent new-user proof installs exact npm 0.4.0 into fresh HOME/npm/cache directories, verifies the published native version/integrity, default immutable release-tag docs, cold no-fetch/offline controls, retained good cache during transient contention, retry, explicit cache upgrade and provenance. No CI binary or embedding-model download is used.