Release durare 0.4.0

[SamuelXing]

Version bump + changelog cut for durare 0.4.0 (library only — durare-macros unchanged at 0.1.0).

The release: schema to reference migration 40, garbage collection + the opt-in retention policy, searchable workflow attributes, atomic send_bulk, the security-posture pass, and AdminServer::start_on. Compatibility notes in the changelog (0.x minor lane: one new required StateProvider method; field additions on five public structs — exhaustive literals only).

Pre-flight (all green):

• cargo fmt --all --check clean
• clippy --all-targets -D warnings clean (only the untracked local cycle_demo.rs flags, which is in [package] exclude and untracked)
• 407 passed / 0 failed (--all-features, live Postgres)
• strict doc build clean
• cargo package --list: 162 files, no internal/planning/benchmark files
• cargo publish --dry-run succeeds

After merge: tag v0.4.0, cargo publish -p durare, GitHub Release from the changelog section.