Release v0.4.0 · janit/gator

Merges are verified as they will land

The integration candidate is verified, not just the branch. When the target branch has moved since a unit started — another unit merged first, say — the merge is built in a scratch worktree, the unit's verifier runs on that exact tree, and the target fast-forwards to it only when green. Two units that each pass alone but fail together now report integration_failed instead of merging a red tree.
A unit merges only into the branch it was fed from. Switch branches before finalising and the unit is held, then merges once you switch back.

--scope accepts file paths and dir/** directories. Other wildcards (src/*.ts) are refused at feed time — they were previously accepted and silently not enforced. "**" still declines scoping.
A unit reported once but not merged (failed, conflicted, unverified, out of scope, integration failed) stays listed by gator status / gator wait until its branch is merged or deleted.
feed, drain and the finalise pass are serialised by a per-repository flock, so concurrent callers cannot race on the budget, the queue or merges. flock (util-linux) is now a runtime requirement.

An interrupted queue drain can no longer launch the same unit twice.
gator sched status reports reserved only for backends configured to honour reservations.
gator auto plan --from with no value is refused with [missing_value] instead of a Python traceback.
auto plan prunes worktrees left registered by an interrupted baseline check.
The test suite runs under a per-run temporary directory and removes it afterwards.

docs/auto.md reason codes match the code.
GATOR_VERIFY_TIMEOUT and GATOR_POLL are documented.
Keep API keys out of worker_cmd: the command appears in process arguments, which other local users can read.