chore(release): bump product version to 0.4.0

[thedancingdeveloper]

Cuts the 0.4.0 product version so the accumulated dev work can be promoted to prod.

Version bump (0.3.1 → 0.4.0)

Canonical version across the gated manifests + everything check_product_version.py enforces: pyproject.toml, src/vogt/__init__.py, web/ + mobile/package.json, build.yml VOGT_PRODUCT_VERSION (×4), the ci.yml version gate, uv.lock, deploy manifests (deploy/.env.example, engine.overlay.yml, vogt.compose.yml), docs image-tag refs, and tests/test_product_version.py. Lockfile 0.3.1 hits that are third-party deps (@jridgewell/gen-mapping, bplist-parser, opaque-debug, …) were left untouched.

uv run python scripts/check_product_version.py 0.4.0 passes; test_product_version green.

Release notes (CHANGELOG [0.4.0])

Reflects the net-new work since the [0.3.1] entry — the six issues reviewed and closed as resolved on dev:

• Added: session history searchable by agents via MCP/API/GUI + retention (Session history: searchable by agents via MCP/API, live+archived coverage, retention #491).
• Fixed: readable history replay (GUI: History renders sessions as raw terminal log instead of human-readable view #490), New-session button size (GUI: "New session" button renders at a massive size #489), terminal lag/replay flood (Terminal: non-selected sessions get force-dropped and flood with a replay on switch (broadcast lag + single-thread drain cascade) #466), promotion CI on the REST API (ci(promote): promote.yml fails — 'gh' not installed on the self-hosted runner #460).
• Security: voice-sidecar ureq/url bump clearing rustls-webpki + idna advisories (security(voice): bump ureq/url to clear rustls-webpki (high) + idna advisories #459).
• Changed: open-source public-tree preparation; deployment-doc clarifications.

Issues #489/#490/#491/#459/#460/#466 have been closed with commit references. Still open and not in this release: #188, #191, #266, #273 (open-source tracking), #467.

Next steps (gated, after this merges to dev)

1. dev deploy + verified receipt → 2. promote dev→main (PR + promote-main approval) → 3. promote main→prod (PR + promote-prod approval) → 4. tag v0.4.0 on the prod commit (release.yml validates the tag is reachable from prod and matches vogt.__version__, builds + signs the image) → 5. estate workflow applies the pinned digest to production (NFR-D10).

🤖 Generated with Claude Code