chore(release): v0.4.0, since LINKS-OPEN-REFS is a new check

Same precedent as v0.2.0 and v0.3.0: a new check code is a minor bump,
not a patch. Bundles the register row for repo #20, the schemaless-host
fix, the reference dedup and the new OK/SKIP outcomes on checkLinks.

Also records the register-freshness decision in CLAUDE.md: --refresh
runs HERE before every release, and consumers of the register are told
not to check freshness themselves. Twice running a newly published repo
was missing when a census ran, and the cost landed in a DIFFERENT repo
than the stale one — portfolio-optimiser's status line stayed put
through a round in which it fixed everything really wrong with it.
Two owners of one invariant is the drift this register exists to remove.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NxP9N3p1fG6UYSB8rATBL6

CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning is [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] — 2026-08-09
+
+### Added
+
+- `LINKS-OPEN-REFS`: the `open/` reference check now reports its own result
+  instead of only its failures. Emitting nothing on success made "no dead
+  references" and "the check never ran" identical in the output — a sweep
+  across the org could not tell 19 clean repos from 19 unread ones (measured:
+  org-ops census 03b). The OK line carries the count it resolved, because an
+  OK that cannot say how many it checked is the same silence in a different
+  colour. Zero enumerated files is now `LINKS-OPEN-REFS-UNAVAILABLE` (SKIP),
+  which is the honest name for the case that used to look like a pass.
+- `portfolio-optimiser-commons` registered as `shared-asset`, the org's 20th
+  repo. Class verified structurally rather than accepted: absent from the
+  catalog's `marketplace.json`, no `.claude-plugin/`, `README.md` + `LICENSE`
+  present, consumed by both reference implementations as a `git subtree` —
+  so `vendor` is the right install form and `## Install` would be wrong to
+  require. Its absence was producing three false `LINK-DEAD` ERRORs in
+  `portfolio-optimiser` against a repo that exists, and leaving repo #20 with
+  zero coverage. Verified after the fact: `portfolio-optimiser` now has no
+  ERROR, and the commons repo measures as WARN with 9 checks passed.
+
+### Fixed
+
+- `LINK-DEAD`/`LINK-NON-REPO` false negative on a schemaless host. `URL_REF`
+  required `://` or `@host:`, so `git.fromaitochitta.com/open/<name>` — the
+  form a subtree instruction routinely uses — resolved to nothing at all
+  (measured: llm-security/V3-UPGRADE.md:343). What makes a name resolvable is
+  its position after a host, not the scheme in front of it. Two guards keep
+  the widening from becoming noise: the host must end in a TLD-shaped label,
+  and a candidate preceded by `/` is a path segment that merely contains a
+  dot, not a host — so `docs/v1.2/open/` and `test/nav.golden/open/` stay
+  silent, and the API-endpoint rule from 0.3.0 is untouched. Measured before
+  shipping across 1501 tracked Markdown files in 20 local clones: 14 lines
+  changed verdict, 13 of them references that were previously invisible.
+- The 14th was a defect the widening introduced, caught by that same
+  measurement and fixed here: a markdown link whose display text repeats its
+  own URL matched on both halves, which prints one dead reference twice and
+  inflates the count the new OK line offers as evidence. References are now
+  deduplicated per name-and-line — two different names on one line, or the
+  same name on two lines, still count as two.
+
 ## [0.3.0] — 2026-08-04
 
 ### Added