chore(release): promote v1.0.40 to main

[LeXwDeX]

Closes #543

Why

Promote the fully accepted dev integration snapshot to the formal v1.0.40 release. A dedicated release delivery branch gives this main-targeted PR its own SpecGit binding and acceptance evidence.

What changed

• Preserve native local-tool results before automatic compaction, including parallel tools and explicit cancellation (fix(session): settle native tools before compaction #539).
• Preserve npm lock files when the plugin SDK resolves locally or from the bundle (fix(core): preserve npm lock when plugin SDK resolves locally #542), and isolate local npm fixtures from online audit latency (test: isolate local npm fixtures from online audit #540).
• Retain later summary diffs after oversized entries, deduplicate identical durable events, and reclaim deleted-session event residue (fix: skip oversized summary diffs individually and drop the dead summary_diffs column #526, fix: dedupe byte-identical durable event appends without consuming seq #527, feat(core): reclaim deleted event aggregates #537).
• Preserve specialized SpecGit bootstrap behavior and enforce delivery branch/base invariants (Delivery auto-close-linked #520, chore(specgit): automate bootstrap around required harness specializations #532–fix(specgit): target delivery pull requests at dev #535).
• Validate macOS archive checksums and the signature of the installed binary (fix(release): separate macOS integrity boundaries #536).
• Include the v1.0.40 release notes and a delivery binding for this PR.

Evidence

Release head: 0e6c95ce387db1d84809f6811fa6d2173bb7b594. Accepted dev baseline: 711e7b5d5fd1b20dfd85db0cfad0ca8b267ca996. The release branch differs from dev only in its own .specgit.yaml binding and v1.0.40 CI evidence notes; all runtime source, tests and gates are identical.

PR #539 passed Typecheck, complete Test CI and SpecGit 1.10.1 before merging. Core: 1225 passed / 6 skipped / 0 failed. Opencode: 4429 passed / 23 skipped / 1 todo / 0 failed. All three HttpAPI modes: 230 passed each, no failures/skips/missing/extra routes. Both E2E platforms and generated-client/SDK checks passed.

The release-version script resolves graphagent-v1.0.40, formal and Latest. Notes render validation passed. The actual template packager validated 16/16 templates at config 9743916ecd0690ee69f424321ab15265c4e59e2a; its 20-file archive manifest matched exactly.

This release PR independently passed Typecheck, lint and DAG core, complete Test CI, and SpecGit Acceptance. The main-targeted run confirmed core 1225 passed / 6 skipped; opencode 4429 passed / 23 skipped / 1 todo; zero failures; all three HttpAPI modes 230 passed each with no failures/skips/missing/extra routes. Generated client/SDK and Linux/Windows E2E passed. Dev post-merge integration CI also passed in full.

Independent Standards and Spec reviews at the release head found zero issues; both verified that runtime, tests and gates are identical to accepted dev. Local SpecGit 1.10.1 finish --json exited 0 with accepted evidence naming PR #544 and exact head 0e6c95ce387db1d84809f6811fa6d2173bb7b594. Acceptance is repeated after this body update before merge.

Checklist

• The accepted dev snapshot is included without losing any runtime changes.
• Independent release Standards/Spec reviews are complete with zero findings.
• All main-targeted checks pass at the release PR head.
• specgit finish --json exits 0 for this PR and exact head.
• After merge, release-fork runs from main and the formal tag, assets and Latest state are verified.