v0.4.0 — ignore rules + password-file

Ignore rules

kopia-push now supports gitignore-style ignore lists with kopia-compatible
semantics (documented subset):

• bare names (*.log, node_modules) match at any depth, files and dirs
• patterns with separators (Library/Caches) anchor to the source root
• trailing / = directories only; ! re-includes (last match wins)
• ** as a whole segment spans any number of directories

Rules come from --ignore flags, --ignore-file files and a default
.kopiaignore in the source root. Matched directories are pruned, so
rules also shorten the run — on the G4 the walk dominates wall time.

--password-file (and KOPIA_PASSWORD)

The password can now come from a file (--password-file) or the environment
(KOPIA_PASSWORD), so wrappers no longer need to pass it on the command
line — where it was visible in ps output while a run was active.

Tests

• tests/ignore-match-test.c — 60+ matcher assertions (anchoring, dir-only,
  negation, **, oversized patterns, CRLF/ comment handling)
• tests/ignore-roundtrip.sh — server round-trip: all three rule sources at
  once, directory pruning, negation, exact ignored-counts in the run log

Binaries

• kopia-darwin-ppc — Mach-O ppc_7400 (G4), statically linked mbedTLS 2.28
• kopia-darwin-ppc64 — Mach-O ppc64 (G5), untested (no G5 in the fleet)

SHA-256 in SHA256SUMS. Verified in production on the G4 (rc=0; with the
ignore rules active the source pushes 96,459 files / 586 MB per run).