v0.4.0

fix(release): bump the npm CLI shim too, and tag before publishing npm

The `surrealguard` npm package lives in npm/, not packages/, and is unscoped —
so the bump loop (which searched only packages/ and matched only @surrealguard/*)
skipped it entirely. It sat at 0.1.0 while everything else moved, which is why
`npx surrealguard` installed a long-stale CLI.

That package and the Zed extension both download a prebuilt binary from the
GitHub Release for their own version, and those assets are produced by
.github/workflows/release.yml on a v* tag. Publishing npm before the tag exists
would turn a stale install into a 404 — strictly worse. `publish` now checks for
the tag, explains what to push, and offers to do crates.io alone (which has no
such dependency) rather than half-publishing.