Release v3.76.0

cratis render now renders Screenplay protected command reads, and the CLI bundles Stage 4.138.0.

Changed

• Bundles Stage 4.138.0: cratis render uses its renderer and cratis run starts cratis/stage:4.138.0 by default. (#388)
• cratis render renders ESM v25 protected command reads (command reads protected) as Arc read protection: each command with reads gets [ReadProtection(On)] and a read-model Handle parameter per read. Reads Stage cannot render faithfully, such as reads combined with constrained events or read paths in produces when, are still refused with STAGE-ESM-044, which now names the reason. See cratis render. (#388)
• Generated single-instance queries keyed by a text or UUID value now take an event source id; UUID keys are matched as text, so callers send the canonical lowercase form. (#388)