release: v0.4.0 — Apache-2.0, core@v0.8.0, and a pre-commit rev that resolves

[bkd-dotcom]

Cuts signetry-precommit v0.4.0, whose headline is a broken install path.

rev: v0.3.0 could never resolve

Both README.md and .pre-commit-hooks.yaml documented the hook as:

repos:
  - repo: https://github.com/Signetry/precommit
    rev: v0.3.0
    hooks:
      - id: signetry-guard

pre-commit resolves rev as a git ref in this repository — and this repository
has no tags at all. The 0.3.0 tag was cut in the pre-move repo and did not survive
the org move, so the documented install did not degrade or warn: it failed outright
with a revision error, for every user who copied the block.

This release is the fix in two halves — it creates a tag (v0.4.0, the first in this
repo) and points both documented rev: values at it. The changelog records why, so the
next reader doesn't have to reconstruct it.

Pins

	was	now
signetry-core (6 sites, 5 files: README, CONTRIBUTING, hooks manifest, universal guard, demo)	core@v0.7.0	core@v0.8.0
advisory reviewer workflow	reviewer@v0.2.0	reviewer@v0.3.0
documented pre-commit rev:	v0.3.0 (nonexistent)	v0.4.0

core@v0.8.0 brings the receipt conformance spec and suite, the policy registry
(signetry policies, signetry init --policy), and placeholder-provenance reporting.

[github-actions]

Signetry Reviewer — 🟣 Escalate to a designated reviewer

Escalate to a designated reviewer — this PR touches security-sensitive surface (.github/workflows/reviewer.yml). No blocking issue was found automatically, but a human owner should sign off.

Deterministic gates (the authority)

Gate	Status
Required status check	— unknown
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings (1, 0 blocking)

• 🟡 Change touches a protected path: .github/workflows/reviewer.yml .github/workflows/reviewer.yml (via cross-check)
  • .github/workflows/reviewer.yml matches a protected pattern (.github/workflows/*). Changes here alter shared/foundational surface and warrant a designated reviewer.
  • Fix: Route to a code owner / architecture reviewer.

Sensitive surface

This PR changes security-sensitive paths that warrant a designated reviewer:

• .github/workflows/reviewer.yml

Merge

A designated reviewer / code owner should sign off before merge (sensitive surface).

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.