v1.4.0

What's Changed

• docs(pr-template): drop skill.json; align checklist to loop.yaml reality by @ulises-jeremias in #284
• docs(contributing): align CONTRIBUTING and AGENTS to loop.yaml reality by @ulises-jeremias in #285
• docs(readme): fix skill paths and community CTAs (#248) by @ulises-jeremias in #286
• docs(security): semver support policy latest minor only (#249) by @ulises-jeremias in #287
• docs(trust): align TRUST.md with actual CI scanners (#250) by @ulises-jeremias in #288
• docs(examples): fix oss-maintenance drift to uvx and loop.yaml reality (#251) by @ulises-jeremias in #289
• docs(community): add CODE_OF_CONDUCT, SUPPORT, MAINTAINERS (#252) by @ulises-jeremias in #290
• docs(getting-started): add GETTING_STARTED tutorial (#253) by @ulises-jeremias in #291
• docs(roadmap): point to Contribution Master Plan Waves 0–2 (#245) by @ulises-jeremias in #292
• docs(aur): add AUR re-dispatch playbook and honesty note (#244) by @ulises-jeremias in #293
• docs(releasing): add RELEASING runbook and bump-version script (#255) by @ulises-jeremias in #294
• docs(adr): retire gen-surfaces in favor of build --check (ADR-003) Fixes #264 by @ulises-jeremias in #295
• docs(release): platform-suffixed binaries with darwin-x86_64 deferred (#256) by @ulises-jeremias in #296
• docs(adr): profiles vs plugins deprecation timeline (ADR-004) Fixes #265 by @ulises-jeremias in #297
• docs(adr): wheel/data packaging SoT and resolution order (ADR-005) Fixes #266 by @ulises-jeremias in #298
• docs(trust): dedup SBOM to canonical sbom.cyclonedx.json (#260) by @ulises-jeremias in #299
• chore(deps): add Dependabot for GHA, pip, and Danger npm (#261) by @ulises-jeremias in #300
• docs: design note for loop runner engines, gates, and state Fixes #267 by @ulises-jeremias in #302
• docs: publish skill→product→target membership matrix Fixes #268 by @ulises-jeremias in #304
• ci(security): add CodeQL workflow for Python on PRs and main (#262) by @ulises-jeremias in #321
• docs(adr): deprecate scripts/install.sh behind Python CLI (ADR-007) Fixes #270 by @ulises-jeremias in #306
• docs(releasing): document notify success vs publish success (#259) by @ulises-jeremias in #303
• docs(adr): decide packs are docs-only (ADR-006) (#269) by @ulises-jeremias in #322
• feat(testing): Wave 4 coverage gate, path/data tests, loop units, ruff and mypy (Fixes #271 #272 #273 #274 #275) by @ulises-jeremias in #307
• docs(showcase): add SHOWCASE.md gallery and README link (#278) by @ulises-jeremias in #323
• docs(troubleshooting): add doctor error recipes for top 5 failure modes (#277) by @ulises-jeremias in #324
• docs(curation): add product curation policy for core/forge/complete (#276) by @ulises-jeremias in #325
• docs(releasing): document downstream PyPI wheel install source (#257 #258) by @ulises-jeremias in #326

Full Changelog: v1.3.0...v1.4.0