Activate v0.4.0 distribution channels

[konojunya]

Summary

• pin the owner Aqua fixture and checksum lock to the published v0.4.0 archives across all four targets
• verify the Aqua-installed native binary reproduces every completion and manual asset
• update the current distribution contract, installation docs, and security support window after GitHub Release and Homebrew verification
• keep self-update explicitly planned because the v0.4.0 manifest does not activate it and direct installs have no receipt
• make release-version drift checks derive from the source contract instead of a stale hard-coded version

Verification

• aqua update and aqua update-checksum reproduce the checked-in fixture
• aqua install --test for darwin/amd64, darwin/arm64, linux/amd64, and linux/arm64
• isolated native Aqua install with --version, init, check, render, and exact completion/manual comparisons
• node scripts/validate-distribution-contract.mjs
• node --test scripts/*.test.mjs
• node --check scripts/*.mjs
• cargo +stable fmt --check
• cargo +stable test --locked
• cargo +stable clippy --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo +stable doc --no-deps --locked