feat!: release 4.0.0 with GA CoCo stack

BREAKING CHANGE: Attestation on Azure is required and configured by
default. Uses GA releases: Trustee 1.0.0+ and OSC 1.11+. Requires
OpenShift 4.17+.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: butler54