v0.4.0

Declarative configs: network files carry the full canonical address table up front and are never rewritten — deployed-vs-not is read from chain state, the fresh-deploy guard keys on factory presence, and [accounts].owner declares the operational owner. The write-back PR machinery is retired.