release: bump to v0.4.0

[viict]

Cuts v0.4.0: the release that carries the usage lenses (#7) and publishes itself
to crates.io and npm.

The bump

Cargo.toml, Cargo.lock and npm/package.json to 0.4.0. The crate job in
release.yml refuses a tag that disagrees with Cargo.toml, so this has to land
before v0.4.0 is tagged.

README, brought back in line with what ships

Three things had gone stale, none of them caught by a test:

• It named one lens when four ship. --lens list prints agent, atif,
  usage and usage-atif; the README and the --lens help block it quotes
  mentioned only agent, which has been wrong since atif landed. The
  trajectory section now shows what --lens usage looks like and says what the
  ↳ marks.
• cargo tree printed tread v0.3.0.
• The static binary was quoted at 649 KiB. The shipped v0.3.0 musl artifact
  is 1 016 560 bytes — 992 KiB.

Verified

• cargo test: 1636 passing, 0 failed.
• cargo test --test keymap_docs: 3 passing — the docs tests still agree with
  the binary.

After this merges

Configure npm trusted publishing for @viict/tread (repo viict/tread,
workflow release.yml, environment Packaging), then tag v0.4.0. The tag
builds and tests all six targets natively, cuts the GitHub release, publishes the
crate, and publishes the npm launcher once the release exists for it to read.