release: prep v0.4.0 — retitle CHANGELOG + login-handler false-positive recipe

- CHANGELOG [Unreleased] -> [0.4.0] (2026-06-15), release-as-a-whole MAJOR.
  v0.4.0 ships 4 new rules + 2 folded no-op fixes. Unlike v0.3.0 (clean
  fleet-wide before tag), v0.4.0 tags known-dirty: per-rule pre-cascade
  audits move to per-territory Phase-B bump time. ^0.3 excludes 0.4.0 so
  tagging auto-adopts nobody; each consumer remediates+goes-green on bump.
- README: new EnforceCurrentUserAttributeRule false-positives section —
  login handlers resolve the user after Auth::attempt() on guest routes,
  so #[CurrentUser] (method-entry DI) injects null. Doctrine-correct fix
  is consumer-side ignoreErrors (n=2: entreezuil/ublgenie store()).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Goosterhof