Release v0.4.0 — promote develop→main (auth + client provisioning, cluster doctor)

[saadqbal]

Release v0.4.0

Promote develop → main and cut v0.4.0 (minor bump from v0.3.1 — net-new command surface).

develop is a strict superset of main (the only main-ahead commits are prior promotion merges), and CI on develop HEAD (722d2cf) is green.

Contents (12 commits since v0.3.1)

• Auth + client provisioning (RFC-0001 · P1 · cli — client create / list / use + location auto-detect + name→slug #84): login/logout/auth status + config + backend client (feat(cli): auth scaffold — login/logout/auth status + config + backend client (cli#83) #85); client create/list/use (feat(cli): client create / list / use commands (#84) #92); cluster-anchor idempotent get-or-create + 409 handling (feat(cli): client create reads the cluster anchor — idempotent get-or-create + 409 (#84) #102); client create --credential-file for the installer handoff (feat(cli): client create --credential-file — write the credential for the installer (#84) #104).
• Cluster doctor (WS3): live-cluster health checks (feat(#88): tracebloc cluster doctor — live-cluster health checks (WS3) #89) + node-fit/image-pull checks (feat(#90): cluster doctor — node-fit + image-pull checks (WS3 follow-up) #91).
• Fixes/infra: dataset rm teardown uid fix (fix(dataset rm): delete staging files from a uid-65532 pod, not jobs-manager (#259) #78); CategorySpec registry refactor (refactor(cli P1): CategorySpec registry — one source for category dispatch (#74) #80); ingest schema re-vendor (chore(schema): re-vendor ingest.v1.json from data-ingestors (fix drift check) #103); CI concurrency + timeouts (ci: add concurrency cancellation + job timeouts to cli CI #82); PII gate caller (ci(security): add public-repo PII gate caller #81).

Known interim state (not blockers — additive, opt-in)

• client create still prints the credential by default; the §9 never-show end-state needs the installer reorder (#838, not yet built).
• --credential-file consumer (#838) not yet wired; location auto-detect (feat(cli): location auto-detect for client create (#84) #93) + RFC ([DRAFT RFC] Browser-based auth & one-command client provisioning #55) still draft.

Acceptance criteria

• Promote PR develop → main merged (merge commit, preserves history).
• main CI green post-merge.
• Tag v0.4.0 pushed → release.yml builds multiarch + cosign-signs + publishes the GitHub release.
• Release artifacts present + signatures verify.

[saadqbal]

✅ v0.4.0 shipped — https://github.com/tracebloc/cli/releases/tag/v0.4.0

• Promote PR release: promote develop → main (v0.4.0 — auth + client provisioning, cluster doctor) (#106) #107 merged → main (57805b2); main build green.
• Tag v0.4.0 pushed → release.yml built all 7 arches, cosign-signed (.sig+.cert per binary), published SHA256SUMS + install.sh/install.ps1. Marked Latest, not a prerelease.
• RC hardening folded in pre-release: Bugbot rounds 1–3 (fix(cli/api): address Bugbot findings on the v0.4.0 RC (#106) #108, fix(cli/push): address round-2 Bugbot findings on the v0.4.0 RC (#106) #109) + a proactive full-RC review (fix: proactive v0.4.0 RC review — fix 4 findings, document 3 non-issues (#106) #110, 4 fixes + 3 documented non-issues).

Note: promoted past the FR gate (red — items at 'FR on dev'); the dev→staging→prod FR step was bypassed for this release by maintainer decision.