v1.4.0

Verify downloads with the accompanying .sha256 files or the
aggregated SHA256SUMS (signed keylessly with cosign —
SHA256SUMS.sigstore.json; see docs/RUNBOOKS.md for the
verification procedure).
Each archive includes build-info.json (git_sha, built, source_date_epoch).
Linux users can install the .deb / .rpm packages directly;
see docs/PACKAGING.md for Homebrew and winget instructions.
After this release, packaging bump (Homebrew/winget) and optional
tap sync run automatically (P11.7 / P11.8).

What's Changed

• Sprint 13: zero-downtime start-first updates (1.4.0) by @RemiPelloux in #10

New Contributors

• @RemiPelloux made their first contribution in #10

Full Changelog: v1.3.1...v1.4.0