rule-trace v1.4.0

Changed

• Cursor .mdc generated importers now use either global alwaysApply: true or glob-scoped alwaysApply: false; existing generated .mdc files preserve frontmatter on sync, so hand-edit the frontmatter or delete/recreate the file before running rule-trace sync.
• Report unwaivedMust / unwaivedMustGaps semantics now follow the strongest configured severity while preserving stable JSON field names.
• Aligned the two CI validate-job wiring snippets (templates/wiring/github-actions.yml, references/ci-wiring.md); documented that their differing install commands (vendored vs. published) are intentional, not drift.