v0.4.0

Added

• The sync workflow scans every generated file a run added or changed for
  secrets before it commits, and a finding fails the run: nothing is committed,
  pushed or deployed. The scan runs ctcdocs-sync scan:generated-diff with the
  gitleaks release project-ci.yml pins, and the project's own .gitleaks.toml
  and .gitleaksignore. It logs each finding as
  ERROR [SECRET_SCAN]: rule=<id> path=<file> line=<n> fileId=<id>, never the
  value, and exits with 5. A gitleaks:allow written into a document is
  ignored, and a path exemption covering a changed generated file fails the run.
  The failure notification reports the new stage secret-scan and nothing else.
  The pushes a sync makes start no other workflow, so until now the project's
  CI never scanned them. See
  ADR-018 and
  Operations.
• A project that moves its project-sync.yml reference to this release has to
  take this release of @ctcstack/ctcdocs-sync with it; the workflow calls the
  new command, and the scan step fails without it.

Fixed

• The browser suite runs the same under an AI agent as without one, and
  ASTRO_PREVIEW_BACKGROUND=1, which 0.3.0 suggested for agents, is no longer
  needed. On macOS and Linux, astro preview from 7.2 onwards moves itself to
  the background when it detects an agent, so test:ux run by one either
  failed because the web server exited early, or passed and left the preview
  holding the port for the next run to reuse. defineUxConfig() now serves the
  build with ctcdocs-preview, a new binary of @ctcstack/ctcdocs that starts
  the same server through Astro's programmatic preview(), which detects no
  agent and keeps no lock file, and stays in the foreground for Playwright to
  stop. The suite no longer runs the project's preview script;
  previewCommand still replaces the command. A preview an earlier run left in
  the background still holds its port and is reused outside CI: stop it once
  with pnpm exec astro preview stop.