chore(release): v0.40.0

[avrabe]

Version bump for v0.40.0. The feature landed in #432 — tools/check_self_test_potency.py, a declared-mutant harness that mechanises self-test potency (closes #405).

What this PR does (bump only, no behaviour change)

• [workspace.package] version in Cargo.toml, Cargo.lock (23 workspace crates via cargo update --workspace), and vscode-spar/package.json: 0.39.0 → 0.40.0.
• REQ-GUARD-SELFTEST-POTENCY-001 promoted implemented → verified (release v0.40.0).

Context

#432 replaced the false prose universal REQ-GUARD-GATE-EVIDENCE-002 once made ("each was mutation-tested…", self-reported and withdrawn in #405) with a standing, CI-gated oracle: for each declared mutant it applies the source substitution, runs the target tool's --self-test, and asserts it now FAILS (CAUGHT); a survivor reds the build. Seeded with four mutants across the two tools #405 falsified (including the exact two it demonstrated), all CAUGHT; non-vacuity is executed via a potent/blind stub pair and per-mutant case-removal.

Cargo.lock diff is exactly the 23 workspace-crate version lines — no dependency churn.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!