v0.0.40

• feat(qfg-4jya): new qfg run command wraps a child process with Quonfig values resolved into env vars — for build steps, migrations, and one-shot scripts that read config from process.env before user code runs (e.g. drizzle-kit migrate, next-auth's AUTH_SECRET). Inline form qfg run --env DATABASE_URL=db.url -- drizzle-kit migrate and env-file form qfg run --env-file=.qfg.env -- next build. Required -- separates qfg flags from the child command. Default behavior overrides parent env (--preserve-env to skip already-set vars). Fail-fast on missing keys before spawning the child. Auth/environment uses a binary mutually-exclusive rule: Mode A (QUONFIG_BACKEND_SDK_KEY set, env encoded in key — error if --environment or QUONFIG_ENVIRONMENT is also set, even if they would agree) or Mode B (no SDK key, requires exactly one of --environment or QUONFIG_ENVIRONMENT). Companion docs site update tracked separately (qfg-kj0e).