release: publish DS Agent v1.4.0

[Lee-take]

What

• Publish the frozen R4 source changes for DS Agent v1.4.0 from the fully validated C4C boundary.
• Keep the public product copy honest about the currently user-reachable T1 path and keep DeepSeek advisory-only: it cannot mint authority or completion receipts.
• Harden scripts/windows-installed-ui-smoke.mjs so packaged Office verification accepts the runtime's absolute created-file path only after proving the canonical file is a regular, non-symlink file inside both the isolated profile and the exact isolated workspace.

Why

The first local R4 candidate correctly created the Word artifact, but the smoke harness treated an already-absolute runtime target as workspace-relative and joined the workspace twice. The one-file correction fixes that harness-only path resolution while adding deterministic relative, absolute, and outside-workspace safety cases.

Release boundary

• Source head: 65d03ca3f47e10bfaa1c3ff5c2c7b5c94c11be4a
• Source tree: 4bb27dd771ffce07a0edd0c01060bbc6be31ee96
• Exact C4C source: 5d8cfefb6ecb8ce79e662a18e60ad34e37a15da6
• No C5A, Step 5, credential creation, paid resources, production accounts, destructive migration, or expanded external effects.
• Windows installer is truthfully NotSigned; release copy discloses the Unknown Publisher / SmartScreen consequence.

Local validation

• Complete Rust: 982 passed, 0 failed, 9 ignored.
• Root test orchestration: all 19 Node suites plus frontend build (1604 modules) and complete Rust passed.
• C4C deterministic matrix: 43 A / 7 F, VOCR 8600 bp, 0 unauthorized writes, 0 DeepSeek authority/receipts.
• Installed Office C4C: passed with the expected receipt and PowerPoint hashes.
• Focused app update / goal continuation / migration / recovery gates: 25 / 8 / 1 / 28 passed.
• Format, secret scan (229 files + 5 self-tests), release-source, release-local, diff, and fresh clippy -D warnings with zero diagnostics passed.
• Two fresh candidate builds were byte-identical.
• Exact installer: DS.Agent_1.4.0_x64-setup.exe, 11,540,369 bytes, SHA-256 eb6e6610f9ae358b38dd2a5a71d37b53130e2e49f6b3fee94abc6672d3a22473, version 1.4.0, NotSigned.
• Static extraction yielded 9 files; the extracted packaged app passed isolated installed UI + real Word artifact verification and verified profile cleanup.