chore(release): prepare 0.4.0 for Service Account support

[moonyue-w]

Summary

Update the SDK version to 0.4.0, the pinned installation command and version-check example. Move the existing SA release notes and migration guidance into the 0.4.0 changelog section.

Why

Prepare the next coordinated SDK release containing the already merged renewable Service Account authentication, direct SAT support and authentication examples. Version metadata and reviewed release notes must match before dispatching the release workflow.

Verification

• make lint
• make build
• make test
• make docs-check
• go build ./examples/...
• Account-backed integration tests run, or not required

Commands and results:

make check-version VERSION=0.4.0
make lint
make build
GOFLAGS=-count=1 make test
make docs-check
go build ./examples/...
All passed.

python3 .github/scripts/release_notes.py check
python3 .github/scripts/release_notes.py extract --version 0.4.0
python3 -m unittest discover -s .github/scripts -p 'test_*.py'
All passed; 19 release-automation tests per repository.

Impact

• Public API or behavior changed
• User-facing changes added to CHANGELOG.md under Unreleased, or not applicable (explain below)
• Generated API documentation updated
• Forward/Managed contract fixtures updated
• Python and TypeScript parity considered
• Migration notes added for a breaking change
• No credentials, .env.live, logs, or generated test output committed

Additional context:

This is a release-metadata PR; endpoint contracts and SDK runtime behavior are unchanged. Existing SA migrations are retained in the versioned notes. API references require no changes and their drift checks passed. Example smoke checks were not repeated for unchanged examples. The merged SA implementation has prior CN/Global read, write, SSE and cleanup verification; live tests were not rerun for this metadata-only bump. The TypeScript release also includes the merged Batch E2E idle-window test correction (#14).