Complete the 0.4.0 release record

[iperev]

Summary

• record the internal typed requirement-source model in the version-bound 0.4.0 additions
• narrow the source-v2 limitation to the unselected codec and absent cutover
• update the independent exact release-note projection oracle

Proof

• go test ./internal/tools/releasechange ./internal/tools/releasepreflight -count=1
• git diff --check
• full local gate passed through Go tests, vet, staticcheck, actionlint, govulncheck, and 91/93 browser tests; the existing large browser scenario reached its 60-second timeout in local Firefox and WebKit under load
• publication remains blocked on all required GitHub CI checks for this exact commit

Non-Claims

• no package bytes, runtime behavior, codec, or public API changes
• no registry publication is claimed before the tag workflow closes