chore(version): update version to 1.4.0

clarify destructive tool warnings

add capability-based tool policy

add shared schema constraints

fix tool schema contracts

chore(version): update version to 1.3.0

fix(cli): reject blank env-file paths and drop artifact alias

fix(policy): catch nested quantified groups in deny regex

fix(pipeline): restore inline artifact file compatibility

fix(pipeline): restore archive download compatibility

fix(pipeline): preserve inline artifact file compatibility

fix(http): disable local artifact write tools over http

fix(pipeline): commit local artifact downloads without clobbering

fix(pipeline): disable local artifact writes in remote auth mode

fix(pipeline): expose inline artifact reads in read-only mode