v0.4.0

⛔ **Breaking: the keyless mode is gone.** `aihawk ui` without an OpenRouter
key used to start on a literal-command placeholder (`go`, `read`, `click`,
`type`, `tab`, `shot`). It now refuses to start, and the refusal says why and
where to go: an agent is a model with a browser, and driving the browser by
hand without a model is what the invisible_playwright library is for - same
engine, Playwright's whole API, `pip install invisible-playwright`. If you
were using the placeholder, the library is strictly more capable; if you need
time, pin `aihawk==0.3.0`.

**What moved in the tests, because the guarantee history matters here.** The
0.3.0 notes recorded four guarantees that died with `do`, one of them "no key
anywhere exits 1 and names both ways to supply one". That guarantee is reborn:
keyless `ui` is refused before the browser is ever constructed, and the test
asserts the refusal names both key routes AND the library. The OPENAI_API_KEY
test now asserts refusal instead of placeholder fallback - what must not
happen is unchanged: someone's OpenAI credential must never be sent to
OpenRouter. The option-surface tests supply a key to reach the link they
inspect. Nothing in the test suite ever depended on the placeholder itself;
the web-service tests always brought their own stub brains.

**The 0.3.0 known issue is closed.** The wiki no longer documents `aihawk do`
anywhere, and the pages that were built on it teach what actually exists: the
cron and monitoring guides now carry a model-free library script (executed,
with its output quoted), the diagnostic page's "replay without a model" moved
from the placeholder to the library (executed likewise), and the page about
running without an API key is gone, with every inbound link rewritten. The
wiki published with this release reflects all of it.