v0.4.0

Fixes the package entry point: the exports map pointed at a source file the tarball never shipped, so importing the package threw ERR_MODULE_NOT_FOUND. Now builds with tsup and ships ESM, CJS and declarations.

Adds guard(), webhook signature verification, and the standard postcept.* span attributes. Idempotency keys are derived from the request body instead of a random UUID, so a retry after a crash no longer verifies the same action twice.