[codex] prepare 0.4.0 runtime hardening release

[andrewkoltsov]

Summary

• prepare the 0.4.0 runtime-hardening release metadata and docs
• document the implemented timeout contract for SDK and CLI consumers
• add a new dated verification note and regenerate openapi.json for the bumped version

Why

Task 11 is the non-TypeScript follow-up to the timeout work that already landed in code. The remaining work is release prep: align the public docs with the implemented timeout surface, move the unreleased notes into a 0.4.0 changelog section, and record fresh verification evidence without rewriting the older pre-timeout note.

What changed

• bumped the package version to 0.4.0 in package metadata
• updated the README timeout wording to call out CLI stderr behavior for both text and json formats
• moved the current unreleased notes into the 0.4.0 changelog entry
• updated release docs to call out runtime-hardening and operational changes in release notes
• added docs/verification-2026-04-02.md with sanitized validation and timeout-contract evidence
• regenerated openapi.json so its version matches the release

Validation

• npm run validate
• node ./scripts/extract-release-notes.mjs 0.4.0
• npx vitest run test/portal-client.test.ts test/synergia-client.test.ts test/librus-session.test.ts test/cli.test.ts -t 'timeout|LIBRUS_TIMEOUT_MS'