Prepare v0.4.5 release hardening draft

[FanyinLiu]

Summary

• add a v0.4.5 draft hardening handoff and draft release notes without publishing a version
• add a source-only v0.4 draft-stack audit with quick PR guard and full release-review mode
• keep package version at 0.4.0 and README stable entry on v0.4.0
• update v0.4 roadmap/changelog/alignment tests so v0.4.5 remains a no-release hardening draft

No Release Actions

• no package version bump
• no tag
• no GitHub Release
• no README stable-entry switch

Verification

• npm run v04:draft-stack:audit:quick
• npm run v04:draft-stack:audit
• node --experimental-strip-types --test tests/v04-draft-stack-audit.test.ts tests/project-alignment.test.ts
• npx tsc -b --pretty false
• npm run verify:release
• npm run package:dir:smoke
• git diff --check

Notes

Asked web ChatGPT for route review before implementation, implementation review after the first pass, and a final check after splitting quick/full audit modes. The final external review reported no hard P0 blocker after documenting the audit hierarchy.