Document bsv-bap 0.4 release gates [OPL-4451]

[rohenaz]

Problem

bsv-bap 0.4 is intended to be a clean break, but the project did not have an authoritative disposition for every 0.1 capability. Several features have no verified replacement and could be lost silently.

Change

• Add a capability-by-capability 0.4 disposition ledger.
• Mark attestation lookup, overlay validity, signing-key history, arbitrary-data encryption, and identity-state portability as release blockers.
• State that 0.4 provides no compatibility shim and that current documentation remains for 0.3.7.
• Record consumer canaries and packaging gates required before release.

Risk

Documentation only; no runtime, package version, API, or generated artifact changes.

[linear]

OPL-4451