v0.4.0 - swarm detection and the exec hand-off

A name catching fire is visible in the data before anyone knows which token is
going to be the one. This release catches that moment and answers the question
it raises, which is not "will this pump" but "eleven of these are copies, which
one is not".

Added

• novamp swarm. A burst of launches collapsing into one cluster inside a
  short window, from wallets that are not each other, is a crowd reacting to
  something. The distinct-deployer bar is what keeps one farm spraying a ticker
  from ten wallets out of the results.
• News correlation with the order checked. A match requires the word, a
  timestamp, and publication before the first launch. An undated item is
  dropped rather than assumed fresh; a headline stamped after the burst is
  labelled rather than quietly counted.
• Public Telegram channels as a source, read through the t.me/s/ web
  preview. No bot token, no API id, nothing joined, no history walk.
• The selection rule in one file. A copy can never win on points; the gates
  that follow are absolute rather than relative, so NO PICK is a real answer
  and is most of them.
• The hand-off. swarm --exec runs a program you wrote and gives it the
  finding as JSON on stdin. novamp still holds no key and signs nothing, and the
  no-signer CI job now scans examples/ as well. See docs/EXEC.md.
• 50 new tests: 177 total.

Fixed

• The densest-window search preferred the later window on a tie, which cut the
  first born out of its own swarm. Ties now go to the earlier window, and
  ranking runs over the burst plus everything that launched before it.
• The phrase check compared a tight-folded term against a loose-folded headline,
  so a multi-word token name never matched a headline containing it.
• channelUrl did not strip a bare t.me/name without a scheme.

Full changelog: CHANGELOG.md