EffectWitness v0.4.0

EffectWitness 0.4.0 is a prerelease that adds a separate, bounded
coding-agent reconciliation evidence lane.

What changed:

• Added schema-v5 artifacts for a deterministic mini-swe-agent 2.4.6 fixture.
  The lane uses the upstream DefaultAgent, DeterministicModel, and
  LocalEnvironment against one synthetic Git patch in a disposable local
  workspace.
• Added four registered scenarios across three rounds: clean,
  save-fault/blind-restart, save-fault/reconcile, and
  save-fault/reconcile-with-tampering.
• Added an application-level trajectory-save fault, a durable
  prepare/execute/effect/commit journal, and reconciliation checks that bind
  the registered pre-state, post-state, patch, command result, and effect.
• Added a fail-closed offline verifier that independently recomputes the
  schema-v5 relationships without importing or running mini-swe-agent.
• Added exact dependency provenance for the public
  mini_swe_agent-2.4.6-py3-none-any.whl:
  115,037 bytes, SHA-256
  a35463c553ac825c7773b03cfa69cd44958e3af20155dcc5711fdf9e4c67cd54.
  The accompanying 93-package version snapshot is a compatibility constraint,
  not a hash lock.
• Added fresh Windows and Ubuntu CI lanes that download the exact wheel,
  install only binary dependencies, run the matrix, verify the artifact
  offline, and run the privacy scanner.
• Bundled a Windows CPython 3.12.10 x86-64 reference artifact with 8 files,
  81,392 bytes, 21 completed worker records, and 15 registered command
  executions. Its manifest-file SHA-256 is
  ce2de79f1c4b19b16cb052adb1b5a47175d4988973f4bef52a8effed4167561c.

Verification:

• The exact tagged commit passed all 13 GitHub Actions jobs across Ubuntu and
  Windows, CPython 3.11-3.13, the real-filesystem lane, the LangGraph replay
  lane, and the new coding-agent lane.
• Local full suite: 236 passed and 2 skipped because this Windows host did not
  allow the two symlink-creation cases.
• Ruff check, Ruff formatting, package build, and the distribution-boundary
  verifier passed.
• The bundled reference verifies with zero reported errors.
• The committed tree, bundled artifact, wheel, and sdist passed the repository
  privacy scanner and a private publication denylist before release.

Boundaries:

The fault is injected at the application-level trajectory-save boundary. This
does not demonstrate native mini-swe-agent process resume, recovery from a hard
machine crash, exactly-once execution, arbitrary patch correctness, model
quality, benchmark performance, production readiness, security, external
review, adoption, deployment, or recruiting outcomes. The fixture is local and
synthetic. It used zero model API calls and zero paid services.