v0.4.0

Added

• Dry behavior benchmark gate (npm run benchmark:behavior:gate) with score
  thresholds, included in npm test.
• Dependency manifest extraction for root npm lockfiles, Maven pom.xml, NuGet
  project files, editable Python requirements, and Cargo package aliases.
• buy-vs-build init CLI for installing AGENTS.md, .buyvsbuild.json, and
  the GitHub dependency-review workflow into another repository.
• Reusable GitHub Action at .github/actions/dependency-review.
• Distribution docs with launch messaging and an example dependency-review PR
  comment.

Changed

• Strict .buyvsbuild.json mode now fails the PR dependency review when new
  dependencies lack a decision note, while still posting the explanatory PR
  comment.
• Tests now use Node's built-in test discovery instead of a hand-maintained
  test-file list.
• Dependency report lookup failures now distinguish missing packages, rate
  limits, service outages, and network failures.
• PR review and dependency audit now use the shared manifest detector, so dynamic
  manifest types such as NuGet project files are actually included.
• Maven manifest extraction now ignores dependencyManagement entries so version
  constraints are not mistaken for directly owned dependencies.