v0.4.0

Minor release — additive and machine-side, nothing here requires action in an already-onboarded repo.

See CHANGELOG.md#040---2026-08-06 for the full list.

Everything in this release came from one real first-time setup on a fresh machine, where the docs were followed verbatim and every place they failed became a finding.

Highlights: commit authorship checking — an opt-in identity block in vault.json so the guard also checks who a commit claims to be from, not just which vault it goes to; make uninstall, which removes only links it can account for and recovers links left dangling by a checkout you already deleted; init-vault.sh writing this machine's config so the vault id and SBW_EXPECTED_VAULT_ID cannot be made to disagree by hand; make doctor telling apart a vault path that points nowhere from one that is merely unfinished, with documented exit codes; make check degrading instead of dying when shellcheck is absent; every shell snippet in the docs made safe to copy-paste into zsh; and docs/NEW-MACHINE.md rebuilt around verification checkpoints with a troubleshooting table that a test keeps in step with the messages the tools actually print.