v0.4.0

Added

• Embedded runs now emit session-correlated audit events and write per-session
  JSONL state, making API-driven runs replayable and easier to inspect (#140).
• Added read-only session and audit commands: scoot sessions list,
  scoot session show <id>, and scoot audit show <session-id> (#141).
• Added the foreground scoot serve stdio NDJSON protocol with run,
  session.list, session.get, and audit.query methods for local app-server
  integrations (#142).

Changed

• Hardened the serve and daemon lifecycle: stdio run uses request-scoped
  result allocation and default retry semantics, and daemon stop only signals
  a process when the pid matches the recorded running daemon state (#143).