chore(release): prepare @hasna/contracts 0.10.4

[andrei-hasna]

Summary

• Bump @hasna/contracts to 0.10.4 across the repository's four coupled
  version metadata locations.
• Add the 0.10.4 changelog entry for fail-closed deployment approval
  authorization and coherent deployment lineage/terminal validation.
• Make no product logic, validator logic, workflow, dependency, or lockfile
  changes.

Source

• Todos task: 260a9503-6127-4cad-9643-476d278fdad3
• Source pull request: fix: enforce deployment authorization lineage #94
• Source merge: df216088c518eb7988e1159e0ab1438136a0c965
• Source tree: 4c53b52284d68658cefed3c1297d93da112707f8

Validation

• bun install --frozen-lockfile — exit 0; 23 packages installed.
• bun test tests/deployment.test.ts — 26 pass, 0 fail.
• bun run typecheck — exit 0.
• bun run verify:release — 1354 pass, 7 skip, 0 fail.
• bun audit — No vulnerabilities found.
• bun run scan:artifact — 223 members scanned, 0 excluded, 0 unreadable.
• npm pack --dry-run --ignore-scripts — hasna-contracts-0.10.4.tgz,
  223 files.
• git diff --cached --check — exit 0.
• Staged gitleaks git --staged --redact --no-banner . — no leaks found.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #95 @ 8c90c4b — lens: correctness+security+gates, reviewer Timon (1 of 1)

Reviewed the exact PR diff from freshly fetched origin/main (df216088c518eb7988e1159e0ab1438136a0c965) to HEAD (8c90c4b83c6546f278723821dd839191a5a6d4fc): CHANGELOG.md, hasna.contract.json, package.json, src/schemas.ts, and tests/published-package-security.test.ts. I also read the surrounding version guards, release scripts, packed-package checks, and the deployment-validation source/tests summarized by the release entry.

Commands run:

• bun install — exit 0; setup only; 23 packages installed.
• bun run typecheck — exit 0; no diagnostic failures; the TypeScript gate reports no pass-count summary.
• bun run test — exit 0; 1354 pass, 7 skip, 0 fail; 13,759 expect() calls; 1,361 tests across 60 files.
• git diff --check origin/main...HEAD — exit 0.

Blocking P0/P1 findings: none.

Security/correctness assessment: the release-only diff keeps all four public version surfaces synchronized at 0.10.4, the packed-package regression verifies those surfaces in source, build output, and the packed archive, and the declared gates are green. The candidate introduces no new trust boundary, credential handling, mutation path, or authorization bypass.

Non-blocking follow-ups: none. Registry metadata currently reports 0.10.3 and does not expose a gitHead, so I am not making a commit-level registry-ancestry claim from absent metadata; the candidate is strictly newer and is based on current origin/main containing the PR #94 deployment-lineage fix.