v0.4.0

## What's Changed
* fix(sdk): self-heal shims when msb binary is missing by @appcypher in https://github.com/superradcompany/microsandbox/pull/575
* execStreamWithConfig for TS SDK by @wellsbunk5 in https://github.com/superradcompany/microsandbox/pull/569
* feat(image)!: block-backed OCI rootfs via VMDK + EROFS fsmeta by @appcypher in https://github.com/superradcompany/microsandbox/pull/548
* fix(runtime): restore VM boot and agentd docker build by @appcypher in https://github.com/superradcompany/microsandbox/pull/579
* feat(agentd): introduce AgentdConfig to read env vars once at startup by @dijdzv in https://github.com/superradcompany/microsandbox/pull/507
* build: use vendored dbus by @Glatzel in https://github.com/superradcompany/microsandbox/pull/562
* Add sandbox-wide guest rlimits by @enricoschaaf in https://github.com/superradcompany/microsandbox/pull/549
* Add keyring feature flag by @enricoschaaf in https://github.com/superradcompany/microsandbox/pull/563
* refactor(agentd): split BootParams out of AgentdConfig by @appcypher in https://github.com/superradcompany/microsandbox/pull/580
* refactor(dns): forward via hickory-client instead of hickory-resolver by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/578
* docs: refresh banner palette and clean up duplicate assets by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/581
* feat(image): support custom TLS certs and insecure registries by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/496
* docs: add recipe for pulling images from local docker registry by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/474
* ci: sync mintlify branch to release commit by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/588
* Adding Secret Injection options similar to the Rust SDK for node-ts sdk. by @wellsbunk5 in https://github.com/superradcompany/microsandbox/pull/586
* feat(network): trust host CAs inside sandbox guests (opt-in) by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/583
* fix(dns): fetch nameservers via scdynamicstore on macos by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/582
* test: add integration test infrastructure by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/547
* feat(dns): intercept tcp/53 and dot/853 queries by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/585
* docs(networking): split into overview, dns, tls, security-model by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/584
* chore(deps): bump rustls-webpki from 0.103.11 to 0.103.13 in the cargo group across 1 directory by @dependabot[bot] in https://github.com/superradcompany/microsandbox/pull/596
* fix(network): improve domain & domain suffix rules enforcement by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/605
* feat(sdk): expose per-sandbox libkrunfw_path override by @appcypher in https://github.com/superradcompany/microsandbox/pull/599
* feat(network): add host.microsandbox.internal alias by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/602
* chore(deps-dev): bump postcss from 8.5.9 to 8.5.10 in /sdk/node-ts in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/superradcompany/microsandbox/pull/614
* feat(volumes): add disk-image volume mounts and unified readonly by @appcypher in https://github.com/superradcompany/microsandbox/pull/609
* feat(network): redesign policy schema with per-rule direction (1/4) by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/618
* feat(network): policy + dns builders with lazy-parse error model by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/619
* Fix command syntax in README examples by @mahmudsudo in https://github.com/superradcompany/microsandbox/pull/622
* feat(cli): --net-rule grammar and flag set rewrite by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/620
* docs(networking): align with new policy, add ts builder by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/616
* feat(sdk-node)!: redesign TypeScript SDK with builder API and bundled binaries by @appcypher in https://github.com/superradcompany/microsandbox/pull/623
* chore: bump version to 0.4.0 by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/627
* fix(ci): pass napi target only to build:native in release by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/629

## New Contributors
* @wellsbunk5 made their first contribution in https://github.com/superradcompany/microsandbox/pull/569
* @Glatzel made their first contribution in https://github.com/superradcompany/microsandbox/pull/562
* @mahmudsudo made their first contribution in https://github.com/superradcompany/microsandbox/pull/622

**Full Changelog**: https://github.com/superradcompany/microsandbox/compare/v0.3.14...v0.4.0