release: SDK 0.4.0, local-vault 0.2.0, n8n 0.2.0 — version bumps

Brings the published packages level with the code shipped since the last
publish (offline-verify exports, attestedFetch, OTel bridges, portable
receipts, head-tracking fix, etc. for the SDK; init+doctor for local-vault).
Versions move in lockstep as the publication-parity contract requires:
PyPI/npm/Go SDK/CLI all 0.4.0. n8n node bumps to 0.2.0 with its @attesto/sdk
dep widened to ^0.4.0. attesto-mcp stays 0.1.0 (first publish).

No package contains source maps or non-runtime source: npm ships compiled
.js + .d.ts only (zero .ts, zero .map, verified), Python wheels ship runtime
.py only (no sdist, no tests), and no wheel/tarball contains anything from
backend/, gateway/, or the Rust prover.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/attesto/main.go

@@ -22,7 +22,7 @@ import (
 	"go.attesto.eu/sdk/connectorkit"
 )
 
-const cliVersion = "0.3.0"
+const cliVersion = "0.4.0"
 
 var supportedVerifyKindNames = []string{
 	"receipt",