chore: bump @iso4/sandbox to ^0.4.0

[schplitt]

Summary

• Bump the @iso4/sandbox catalog entry from ^0.3.0 to ^0.4.0 (release notes: https://github.com/schplitt/iso4/releases#release-@iso4/sandbox@0.4.0), pulling in matching @iso4/v8-* runtime binaries.
• No source, type, or public-API changes were needed — the bump is fully backward compatible for how durable-isolates uses the sandbox.
• Added a changeset (patch on durable-isolates; durable-workflows picks up the bump transitively via updateInternalDependencies).

Verification

• pnpm build → both packages build clean
• pnpm test:run → 46/46 tests pass (durable-isolates 27, durable-workflows 19)
• pnpm lint → clean
• pnpm typecheck → clean
• tsnapi public-API snapshots unchanged (no type-surface drift)
• Ran a small throughput spike comparing 0.3.1 vs 0.4.0 (hydrate/precompile cost, cold sequential dispatch, warm cache replay, parallel fan-out) — no regression; hydrate and cold-dispatch paths trended ~5-20% faster on 0.4.0, plausibly from the release's move to native host-import module construction and V8-API global installation instead of generated/prepended JS.

Notes for follow-up (not in scope here)

The 0.4.0 release notes surface a couple of items worth remembering for later work, not actioned in this PR:

• Corrected in-sandbox stack traces (globals no longer prepended as JS) — relevant to the known iso4 bridge error-loss gap.
• A new data global kind for passing plain constants as WireValues, which could simplify how workflow input is currently baked into the generated entry as JSON.

Test plan

• pnpm build
• pnpm test:run
• pnpm lint
• pnpm typecheck