v1.4.0

What's Changed

• docs: mark v1.3.1 shipped + record wp.org deploy-dispatch lesson by @dknauss in #89
• test(e2e): fix reorder-test flake at Reset All + CI retries by @dknauss in #92
• docs: footprint & performance stats in README + readme.txt by @dknauss in #93
• docs(planning): fix v1.4.0 changelog diff base (Codex P2 from #89) by @dknauss in #90
• ci: review gate for unaddressed P1/P2 findings by @dknauss in #91
• test(e2e): retryable auth setup project (fixes fatal globalSetup) by @dknauss in #94
• docs: refresh README Status + TESTING to v1.3.1 and live-verified test counts by @dknauss in #95
• docs(planning): add v1.5 research todo — analyze Admin Menu Editor prior art by @dknauss in #97
• build(deps-dev): bump @wordpress/env from 11.9.0 to 11.10.0 by @dependabot[bot] in #98
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #99
• build(deps): bump actions/github-script from 7 to 9 by @dependabot[bot] in #100
• docs(compat): Admin Menu Editor prior-art analysis for Phase 20 by @dknauss in #105
• chore(deps): clear npm audit advisories in dev tooling by @dknauss in #107
• fix(replay): pass through custom_menu_order value when no stored order by @dknauss in #106
• docs(compat): record custom_menu_order pass-through fix as COMPAT-14 by @dknauss in #108
• build(deps-dev): bump @playwright/test from 1.61.1 to 1.62.0 by @dependabot[bot] in #104
• build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #102
• Phase 20: Third-Party Compatibility Fixes (COMPAT-04/07/10) by @dknauss in #109
• Security hardening: cosmetic-only invariant, config size bounds, release workflow by @dknauss in #111
• build(deps-dev): bump @playwright/test from 1.62.0 to 1.62.1 by @dependabot[bot] in #110
• Release v1.4.0 — Compatibility, roles & hardening by @dknauss in #113

Full Changelog: v1.3.1...v1.4.0