Draft v4.0.0

Changed

• Graph wrappers fail loud on shapeless JSON. gq_run requires a
  .rows array; graph-impact / graph-callers / mermaid-from-graph
  require the tool-shaped object. A bare {} is source:"unavailable"
  with a non-zero exit, not a measured empty result. Callers that treated
  empty objects as "no callers / no cycles / no edges" must handle
  unavailable / exit 2 instead. A failed snapshot refresh no longer
  rewrites schema.yaml.
• draft install help matches host defaultScope. --global is the
  default for claude-code and cursor; --project is the default for
  codex and opencode. hasBinary treats Windows status 127 as missing.
  Graph fetch uses the install timeout. Cursor registry maps that are
  arrays are replaced, not silently dropped.
• Docs, website, and book aligned. Public copy names Mayur Pise as
  author. Counts: 53 helpers, Copilot integration ~25,300 lines, 66 core
  files, tech-debt 7 dimensions, 81 test suites, hero/book REV 4.0.0.
  Graph-query docs record that shapeless {} is unavailable. Installer
  copy names host default scopes.

Fixed

• fetch-memory-engine.sh pins curl redirects to HTTPS.
• OKF viewer XSS: table cells are escaped; javascript: markdown links
  are dropped. Catalog concept_id and path-index values cannot escape the
  bundle.
• resolve-tools.sh falls through on an unreadable marker or malformed
  installed_plugins.json. Copilot syntax transform no longer rewrites
  emails like user@ops.example.
• Hygiene / packaging: scan-markers.sh parses paths that contain :;
  check-repo-size.sh prints spaced blob paths whole; package.sh refuses
  --out / and --version with ..; chapter pages are written atomically;
  the Release workflow treats release-notes.sh exit 2 as a hard failure;
  architecture render no longer swallows okf-fix-links failures.