feat: release LightWorker v0.4.0 native sessions

[wxai-space]

Summary

• deliver the unified dynamic Agentic Loop while retaining fixed LightFlow workflows as an explicit option
• add auditable Web, browser, Docker-only shell, MCP, Markdown Skills, scoped memory, SQLite FTS5 RAG, goals, context compression, and bounded subagents
• persist run-level LightAgent Session, Inbox, Goal, Budget, and lifecycle state for main agents, repair turns, and subagents
• make the conversation-level LightAgent Session the source of truth for queued follow-ups, steering, retry, completion, and restart recovery
• retain message-queue.json only as a compatibility cache and automatically migrate earlier JSON queues
• expose lightagent-session.json, lightagent-runtime.json, lightagent-conversation.json, and the Web conversation_runtime projection
• update the package to LightWorker 0.4.0 and document the LightAgent roadmap and runtime compatibility

Safety and compatibility

• shell and stdio MCP execute only through the task Docker container; there is no host-shell fallback
• browser sessions use temporary profiles and block private-network targets and downloads by default
• Playwright remains the default browser backend; DrissionPage is optional
• model credentials remain outside the committed files
• existing Web follow-up, queue, guidance, SSE, approval, and task-detail APIs remain compatible

Verification

• pytest -q -ra: 102 passed, 2 skipped
• skipped tests require an available Docker daemon and LightWorker image
• ruff check src tests
• ruff format --check src tests
• git diff --check
• tested locally with the released LightAgent 0.10.0 runtime, which corresponds to the previously planned LightAgent 0.15 capability milestone