v4.0.0: Full coverage, harder sandbox, actual deployability

Breaking (hence the big number)

• serve-http refuses to start with DOKPLOY_MCP_SANDBOX_RUNTIME=local — hosted multi-client plus vm-only isolation was never a good pairing.
• Sandbox workers now have a real memory ceiling (default 256 MB, DOKPLOY_MCP_SANDBOX_WORKER_MEMORY_MB) and a concurrency cap (DOKPLOY_MCP_SANDBOX_MAX_CONCURRENT, default 4).
• The execute contract for raw code changed: multi-statement code without a top-level return now returns null instead of throwing a SyntaxError, and a return inside a callback no longer swallows your result.
• The test:phase2..5 scripts are gone (leftover v3 migration scaffolding).

API coverage: 524 → 544 procedures / 50 tags

The entire forwardAuth module, SCIM, deployment.readLogs (with log capping and secret redaction, including in logs.tailMany), compose.previewTemplate, SSO and build-concurrency settings. Plus a weekly OpenAPI drift guard so this never silently lags again.

Sandbox

Isolation characterization tests (the empty worker env is now pinned by a test, not by hope), memory ceiling, concurrency semaphore, opt-in warm worker (DOKPLOY_MCP_SANDBOX_WORKER_REUSE), and faster schema materialization.

Workflows

The deploy workflow no longer reports failure mid-rollout-polling when the deploy already fired (rolloutStatus: budget-exhausted).

Hosting

Dockerfile, compose with TLS at the proxy, deploy guide. server.json no longer points at infrastructure nobody could actually stand up.

Small things that hurt

Secret redaction in arrays and broader patterns, .env.example, a version-alignment tripwire in CI, a warning on CORS *, loosened dependency overrides (security patches flow again).

What's Changed

• Release v4 hardening and hosted deploy by @vcode-sh in #36

Full Changelog: v3.1.2...v4.0.0