Surface reproducible proof and v0.4.0 changelog

[TueJon]

Summary

• promote the existing reproducible Chrome proof near the README top
• add a v0.4.0 changelog covering the shipped discovery and trust work
• declare the package as ESM so Node no longer emits the typeless-package warning

Verification

• npm run check (17/17 tests)

[TueJon]

README.md:25 — The newly surfaced “full verification run,” “Nothing in the recording is staged output,” and “entire integration patch” claims describe an end-to-end skill run that the linked artifacts do not perform. proof/demo/run.mjs:63-102 and proof/demo/run.mjs:152-165 hard-code the inventory, integration, and audit narration, then dispatch registration of a tool module already present in the fixture; proof:verify never invokes the webmcpify inventory/integrate/audit pipeline or derives and checks the before/after manifests. proof/integration.patch also abbreviates the implementation as createToolScope(...), so it is not the entire reproducible patch. The harness does reproduce native getTools()/executeTool() verification, but not the broader pipeline proof claimed here. Please either label the recording as a scripted runtime-verification demo and the patch as illustrative, or make the harness generate and assert the advertised pipeline artifacts before presenting it as unstaged end-to-end proof.

[TueJon]

Addressed the blocking proof-scope finding in b97c38d. The README and proof documentation now state that the phase narration, manifests, and illustrative patch are prepared fixtures; the reproducible claim is limited to the real approval-to-registration handoff and native Chrome getTools/executeTool assertions. npm run check passes 17/17 and CI is green.