[iuyo5678]

Prepare the coordinated 0.4.0 release from main after #520. Align the CLI, extension and DSH versions and local Cargo lock entries, finalize the October 30 changelog, and preserve previous release history.

Document the upgrade requirements: extension 0.4.0 requires daemon protocol >= 1.6, while CLI/daemon 0.3.3 uses 1.3. Users must update the CLI and restart its daemon before updating the extension, then update DSH and reload the skill. New sessions enable shared control; custom actions need a fresh single-use observation context. The changelog and READMEs cover collaboration, drag/range gestures, step, saved observations, incognito tasks, tab groups and macOS signing/notarization.

Update both privacy policies for tabGroups, automatic shared-control observations, explicit JSON saves on the CLI host, persistence and deletion of those files, incognito boundaries, manual control and daemon-compatibility notifications. Keep the historical 0.3.3 tool-name migration guide and add a separate 0.4.0 upgrade guide.

Validation completed locally with Node.js 22 / npm 10 and the locked dependencies:

• Version/lock consistency, unchanged historical release notes, new relative links and migration headings; git diff --check.
• cargo fmt, cargo clippy --workspace --all-targets --locked -- -D warnings, and cargo test --workspace --locked: 963 passed, 1 ignored. The built CLI reports bsk 0.4.0.
• Full pnpm lint, extension TypeScript compilation, 668 DSH tests, 64 localization tests and 148 VOM tests passed.
• Extension tests: 3,367 passed; 334 opt-in browser/platform cases skipped locally and left to the applicable CI jobs.
• 18 Node script tests, 8 Windows signing protocol tests and 10 macOS signing protocol tests passed; both skill bundles validated.
• Extension ZIP built with manifest version 0.4.0; every declared permission is covered by both privacy policies. DSH build and actual npm archive/runtime resource verification passed.

After merge, use one merge commit for all three tags. Before rollout, verify the new CLI's intended basic workflows with the previous store extension and confirm both internal signing pipelines are ready. Publish cli-v0.4.0 first and wait for both Publish CLI verification jobs and final public publication. Synchronize Chrome/Edge permission and privacy disclosures, publish ext-v0.4.0 and wait for store availability, then publish dsh-plugin-v0.4.0 through the npm-publish environment. Cross-version browser smoke testing and actual signing/publication are release-stage checks, not claimed by the local test results above.