v0.4.0

Added

• DBOS TypeScript adapter (dbos-ts): a zero-infrastructure
  durable target for Node shops (shares _ts_common with Cloudflare).

Changed

• DBOS is now the default runtime.

Security

• Hardened the IR and every emitter against code injection from crafted
  pipeline.yaml input (charset-constrained id/signal/impl fields at
  the IR boundary; escaped prose at emission).