docs: reconcile v4.0.0 GA versioning + metadata hygiene

[Davincc77]

Summary

Minimal documentation/metadata hygiene PR for v4.1 finalization prep. Reconciles the public-doc version contradiction and fixes stale metadata. No code behavior changes, and no release mechanics — no git tag, no GitHub Release, no npm/PyPI publish, no Zenodo deposit, no latest dist-tag flip. Public release stays controlled.

The contradiction fixed

SPEC.md header still claimed Version: 3.5.1 / Production while README.md, CHANGELOG.md, package.json (4.0.0), the strict v4 GA schemas, and docs/releases/v4.0.0.md (Status: GENERAL AVAILABILITY) all present v4.0.0 as GA. The repo files support v4 GA, so SPEC is promoted to match — while keeping the v4.1 candidate/benchmark/DOI track explicitly not GA / not normative.

Changes

• SPEC.md
  • Header Version: 4.0.0 (GA); Status: General Availability — v4.0.0 (additive over v3.5.1).
  • "Current status" subsection, the SDK reference line, and the "Wire version vs. release version" note updated to v4.0.0 GA / 4.0.x packaging track. Wire envelope nuance preserved (klickd_version: "3.0", crypto/AAD unchanged; v4 signalled via payload_schema_version: "4.0").
  • Version-history table: 3.5.1 → Stable, new 4.0.0 → Current (GA) row, new 4.1 → Candidate/benchmark (not GA) row (replaces the old 4.x Draft/RFC row).
  • §33 v4 preview section marked historical / superseded by v4.0.0 GA (content retained for design provenance; GA status governs on conflict).
  • Added a claim boundary note in the header.
• package-lock.json: aligned stale 4.0.0-preview.1 → 4.0.0 to match package.json (already 4.0.0). No release-version change beyond what package.json declares; root package is private: true.
• README.md
  • Reference SDKs (4.0.0) → Reference SDKs (4.0.x packaging track) — npm @klickd/core is at 4.0.3 and PyPI klickd pyproject is 4.0.3.
  • Added a claim boundary note mirroring the DOI / universal-bridge disclaimer: no universal native support, no automatic GDPR/EU AI Act compliance, no claim of external benchmark superiority, v4.1 candidate track not GA.
  • Added a non-destructive Historical files note for SKILL_v25.md, SKILL_v30.md, SPEC_v30.md, klickd_v330_spec.pdf (files left in place — CI workflow and audit notes still reference them, so a move was deliberately avoided).

Decisions

• SPEC → v4 GA normative: repo files (strict v4 GA schemas, GA release notes, package.json 4.0.0) already support v4 GA, so this is not overclaiming. The non-GA distinction is applied to v4.1, the candidate/benchmark/DOI track.
• Legacy files not moved. They are referenced by .github/workflows/test-vectors.yml, AUDIT_v60.md, CONTRIBUTING.md, demo HTML, and RFC/issue templates. A move would risk breaking links/CI — out of scope per the "no risky large file move" guidance. Marked historical via README note instead.

Testing

• npm test (node verifier incl. v4.0 GA strict vectors): 47/47 passed, 13 skipped (optional hash-wasm not installed).
• python verify_vectors.py: 46/59; the 13 "failures" are entirely missing optional deps (argon2-cffi, jsonschema) — none related to these doc/metadata changes.
• JSON validity + version consistency: package.json and both package-lock.json version fields all 4.0.0 (match confirmed).
• All new README/SPEC link targets verified to exist.

Deferred / out of scope

• Release mechanics (tag, GitHub Release, npm/PyPI publish, Zenodo deposit) — intentionally not touched.
• Optional dev deps for full Python suite (argon2-cffi, jsonschema) — pre-existing, unrelated.
• Physical relocation of legacy root files into an archive/ dir — deferred to avoid CI/link breakage.

🤖 Generated with Claude Code