Release v4.40.0

The components the foundation screen templates (Part B 2.2-2.9) are built from, so the templates that follow are only their arrangement, slots and metadata. Same machinery and rules as the first fifteen (states frame, strings table, tokens only, locale, permissions, jsdom axe, Chromium audit).

Added

• dataList: the records of a collection as a table, as cards, or grouped with subtotals, with search, sort, paging, selection (one or many), row actions and a filter (the filter builder's value). Search, sort, page and selection live in the address under a urlKey prefix, so a shared link or a refresh restores the list. Sorting cycles ascending, descending, none, and the header says so in words and in aria-sort. A table becomes cards on a phone, with nothing hidden. Real table elements: a screen reader announces row and column. Cells are text, number, currency, date (all locale-formatted) or status (tone + icon + text).
• tabSet (the ARIA tabs pattern, the active tab in the address, the content of tab overview is the slot overview) and subNavigation (a module's sections as tabs or a left rail, aria-current, a deep link restores the section).
• bulkBar: appears only while records are selected, says how many politely, offers bulk actions with permission rules, clears the selection.
• globalSearch (a search landmark; text is the output and can live in the address; Escape clears) and notificationsButton (the unread count said in words, the badge hidden from assistive technology).
• kanbanBoard: columns mapped to a status with cards that move by dragging and by each card's own "Move to" menu (the keyboard and screen-reader path), every move announced, per-column limits that say "Over the limit" in words, collapsible columns, read-only without the move permission; a card whose column is gone is shown in the first column rather than lost.
• wizardProgress: linear steps, Back/Next/Finish and Save draft; Next is blocked while the step is not valid; the last step is the review; completed steps are revisitable but a step cannot be opened before those ahead are done; the current step (address) and completed steps (session) survive a refresh and a refresh cannot land past a step that was not done. Storage access is guarded, so a sandboxed frame loses only the memory (the Chromium audit caught this).
• formScreenBody: titled sections in a 1-3 column grid with eleven field types (text, number, currency, date, select, multi-select, lookup, toggle, file, rich text, address), inline validation on blur and a summary on submit that takes focus, server errors mapped onto fields (an error for an unknown field becomes a general one, never lost), required marked by asterisk and word, four modes (create, edit, read-only, settings with a save per section), a sticky action bar, and an unsaved-changes guard (beforeunload + Discard). It collapses to one column on a phone.
• Shared: useUrlState (state that lives in the address without a history entry per keystroke) and useCompactWidth.
• Descriptors, categories, stories, specifications for every model and control; all nine in the every-state jsdom audit and in the Chromium audit at desktop, tablet and phone in both themes (169 browser checks pass).

Fixed

• The foundation root now sets min-inline-size: 0/max-inline-size: 100% and the scroll containers establish their own containing block, so a wide table or board scrolls inside itself instead of widening the page (the Chromium audit caught a 951px page in a 768px viewport).

Part of #107