docs(release): disposition v4 release identity incident

[aatuh]

Refs: REL-000

Summary

• records the final, evidence-based status of all affected v4 root and contrib tags
• establishes root v4.0.1 as the sole verified root-module compatibility baseline
• withdraws v4.0.0, contrib/v4.0.0, and contrib/v4.0.1 without moving or recreating published tags
• aligns the release runbook, support policy, changelog, release notes, and documentation contracts
• recognizes [pr] as an active backlog status in the scorecard contract

Evidence

• tag/proxy/reachability and release-asset evidence was reproduced from a clean checkout on 2026-08-15 and is retained in docs/release-incident-v4-release-identity.md
• GOWORK=off GOTOOLCHAIN=local make docs-check passed
• API_BASE_REF=v4.0.1 GOWORK=off GOTOOLCHAIN=local make release-check was run through its release subchecks; required protected CI remains the merge authority

Safety

This does not retag, delete, or overwrite releases. A later paired contrib repair must use a new SemVer-correct tag with clean protected release evidence.