Release v0.4.0

[github-actions]

Release v0.4.0

Auto-generated by the Prepare Release workflow.

What changed

• de_shell/__init__.py bumped to 0.4.0 — the one place the version is
  written, and the value publish.yml refuses to let a tag disagree with
• Pre-flight checks passed: git dependencies pinned to SHAs or tags
• CHANGELOG.rst assembled from the fragments in upcoming_changes/

Release notes (as they will appear in `CHANGELOG.rst`)

0.4.0 (2026-09-26)
==================

New Features
------------

- Apps gained a way to serve their backend's protocol to a remote client: ``createRelay`` (exported from ``@de/shell-main`` with the ``encodeMessage`` and ``encodeBinary`` encoders) listens on a TCP port and speaks the PLOTAPP/PLOTBIN framing, and ``de_shell.remote_client`` is its synchronous, standard-library Python client. (`#12 <https://github.com/directelectron/de-shell/pull/12>`_)

Review checklist

• CHANGELOG.rst reads well — edit the assembled text directly if needed
• Version is correct in de_shell/__init__.py
• CI passes — but note it does NOT start on its own here: GitHub suppresses
  workflow runs for events raised with GITHUB_TOKEN, so a PR opened by this
  workflow gets no pull_request run. Close and reopen the PR, or push an
  empty commit to it, to get one. The wheel-contents leg is the one that
  matters most: it fails if de_shell/js is missing, which is the whole
  point of the package.

Manual check CI cannot cover

CI never runs Electron — it typechecks the TypeScript and runs the node unit
tests, nothing more. Before tagging a release that touched the sidecar
protocol or de_shell/js:

• Link this tree into one app (python -m de_shell.js prints the path)
  and run that app's e2e suite against it.

After merging

Tag the merge commit on main — the tag MUST be exactly v0.4.0:

git fetch origin
git tag v0.4.0 origin/main
git push origin v0.4.0

The tag push triggers publish.yml: it refuses a tag that does not match
de_shell.__version__, builds the distributions, checks the wheel carries
de_shell/js, and uploads to PyPI through trusted publishing.

• Confirm it actually published before telling the apps to pin it:
  uv pip index versions de-shell should list 0.4.0.