Bump to 0.4.0

[sea-snake]

A minor bump rather than a patch, because the served tool surface changed
incompatibly since 0.3.0.

Every tool that reaches a canister is now gated on the owning app's
service-discoverability manifest (#184). get_canister_candid,
get_canister_api_doc, get_canister_oql_schema and canister_query used to
work on any canister; they reach one only when the app that owns it declares
that canister at /.well-known/ic-architecture, exactly as
canister_update_call already did. Each of the four grew an optional app_url
naming the app whose manifest decides, and every successful reply echoes
declared_by/declared_at. A client that read an undeclared canister against
0.3.0 gets a refusal here.

open_app moved with it: it probes only declared canisters for their
oql/api-doc flags, so a candidate mined from /env.json or the JS bundle comes
back with null flags and without the [declared] marker, and the server
instructions no longer promise that reading is ungated.

No public Rust item changed — the gate lives in the private discover and
discoverability modules — so an embedder still compiles against 0.4.0
unchanged. What changed is what its server answers, which is the part its own
users see.

Under cargo's 0.x rules 0.3 is the compatibility range, so shipping this as
0.3.1 would hand that break to everyone on imcp2 = "0.3" — the requirement
our own README recommends — the next time they ran cargo update. 0.4.0 opens a
new range instead; existing users stay on 0.3.x until they choose to move. The
README's dependency line follows, as "0.3" would no longer resolve to a
current release.

The other two changes since 0.3.0 are the status dashboard's landing-page check
(#181) and the operator-facing terms references (#182); neither touches the
crate.

imcp2-core moves in lockstep: publish-crate.yml checks the tag against both
manifests, and the workspace pin that binds them (imcp2-core = { path = …, version = … }) has to name the same number or the path dependency stops
resolving. imcp2-local moves with them — it releases on its own
imcp2-local-… version tags and has never been cut, so there is nothing to keep
it behind, and its --version output would otherwise report 0.3.0 from a 0.4.0
tree.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The version bump is complete and consistent across manifests, lockfile, dependency pin, and documentation.

Pull request overview

Bumps all workspace crates to 0.4.0 for the incompatible tool-surface changes since 0.3.0.

Changes:

• Updates all crate versions and the shared dependency pin.
• Refreshes the lockfile and README dependency example.

File summaries

File	Description
Cargo.toml	Bumps imcp2 and the core dependency pin.
Cargo.lock	Synchronizes workspace package versions.
crates/imcp2-core/Cargo.toml	Bumps imcp2-core.
crates/imcp2-local/Cargo.toml	Bumps imcp2-local.
README.md	Recommends the new compatibility range.

Review details

• Files reviewed: 4/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.