Bump to 1.40.0

[ww-mw]

Releases the maintainer's 2026-10-16 group E ruling in core. Damaged input warns and shows what was read instead of
refusing the file or crashing: a zip member that inflates past its declared size is unreadable, never truncated (#121);
the MCOS decoder reports blocks it stopped reading and variables its confidence gate skipped (#122); a struct array
with a non-matrix slot, nesting past 128 levels, a numeric value with no payload, undecodable text cdata, a model
workspace variable with an overwritten flags word and a typeless catalog definition are shown not decoded or warned
about (#126). Properties follow MATLAB: LookupTable and Breakpoint have no Description, VariantBank and its CoderInfo
no Value, a Signal's Complexity and DimensionsMode are dropdowns, and Alignment is editable where MATLAB allows it
(#124); an MCOS object's non-double values keep their class and singles show MATLAB's digits, and a .mat object array
keeps each element's class through one rule shared with the binary reader (#128). A binary dictionary's nested objects
show in Other, a cleared envelope property is saved as MATLAB saves one, a VariantControl refuses a Description edit,
model references and data sources get one id per row, and CI fails when the committed dist is not a clean build (#123).
addEntry refuses a name MATLAB cannot use, and a paste of an mpt entry MATLAB already wrote is admitted, through the new
SectionNode.getAdmittedTypes (#125). Two entries with the same id refuse id-addressed operations and warn duplicate-id
at open, a model's MAT-file workspace is searched for Usage right after its own workspace, a lone config set or
reference index that is not a list is read, and struct/object-array elements are named from 1 in both flavours (#127).
A minor version, since it adds public API (getAdmittedTypes, the duplicate-id warning code, ParsedSlx.workspaceDataSource,
an optional warnings parameter on session.addProjectSource).

Gate: npm run verify passed (rc 0). Test files: 257 passed, 1 skipped (258). Tests: 8501 passed, 26 skipped (8527).
The other stages were also green: typecheck, build, smoke, check:pack, check:leak and check:browser (161 modules, no
node: builtins); dist/ rebuilt from scratch is unchanged.