Release v0.4: expanded agent security coverage

[K14-coder]

Summary

Expands agent-preflight into a more complete local-first security gate for AI coding-agent instructions, MCP configuration, scripts, package manifests, and GitHub Actions.

• Adds versioned policy files, strict profiles, reviewed baselines, inline suppressions, and output limits.
• Adds all-match detection, GitHub annotations, step summaries, and expanded action outputs.
• Adds checks for credential-shaped tokens, pull_request_target, MCP package bootstrapping, lifecycle hooks, and verification bypasses.
• Adds a threat model, operations guide, integration guidance, examples, and a complete rule catalog.

Validation

• 17 passing Node tests
• npm run lint
• Composite action YAML parse check
• Baseline, Markdown, SARIF, GitHub-output, and clean self-scan smoke tests

Release

After merge, create the v0.4.0 action tag before using the documented action reference.