chore(release): 0.4.0

[fohara]

Cuts 0.4.0. Version bump, Cargo.lock refresh, and the [Unreleased] section moved into a dated ## [0.4.0] heading with link refs updated.

Minor rather than patch: lash migrate-ids is a new command.

What ships

Added — lash migrate-ids, which rewrites @depends-on references left dangling by a task-ID derivation change. Reports by default, writes only with --write.

Fixed

• Stale task IDs no longer survive lash index. The index now records the derivation version it was built under and re-derives when that does not match, so an upgrade repairs itself.
• lash check-index compares stored IDs against freshly derived ones, not just content hashes.
• lash lint distinguishes a reference moved by a derivation change from a genuinely missing task.
• lash add --before/--after accept the file-qualified task ID that lash show and lash list print.
• lash add --dry-run resolves the request instead of echoing it back.

Why now

The stale-ID bug is live in 0.3.1, and check-index reports in-sync throughout, so affected users have no signal anything is wrong. The fix repairs itself on the next lash index after upgrade — the release is the delivery mechanism.

Verification

• cargo test --workspace --all-targets — pass
• cargo test --doc — 48 passed, 0 ignored
• Pre-commit hook (fmt + clippy) — pass

dist-workspace.toml untouched, so release.yml stays in sync and the plan job's up-to-date check should pass.

After merge

Tag the merge commit and push to trigger the release build — not done yet:

git checkout main && git pull
git tag v0.4.0
git push origin v0.4.0