Cut v1.4.0 and point the README APM pin at it

[AlexDeMichieli]

Every fix in #45 lands on main and reaches nobody. This is the step that makes the work real.

The state today

Source	Version	Exists as a tag?
plugin/plugin.json	1.4.0	no
.github/plugin/marketplace.json	1.4.0	no
apm.yml	1.4.0 (after #45)	no
README APM pin	#v1.2.0	yes, May 26
Latest actual release	v1.3.0	Jun 22

Verified: tags v1.0.0 through v1.3.0 exist. There is no v1.4.0.

Why it matters

Both v1.2.0 and v1.3.0 still contain the three MCP tool references and the bamboo stray fence. I checked them out and confirmed. So no released version carries any of the #45 fixes, including the corrected SHA-pinning guidance.

The README also points at v1.2.0, which is two releases behind.

Separately, v1.3.0 was tagged without bumping its own plugin.json — checked out, it reports 1.2.0. The numbering has been drifting for a while.

What to do

1. Tag and release v1.4.0 from main after fix: restore knowledge/plugin content parity and remove MCP leaks #45 merges
2. Update the README APM pin from #v1.2.0 to #v1.4.0 in the same commit

Order matters: changing the pin before the tag exists breaks apm install against a nonexistent ref, which is why #45 deliberately left it alone.

Already handled in #45

apm.yml was 1.2.0 while the other two manifests said 1.4.0. That is fixed, and a coherence check now keeps the three in sync. The README pin is deliberately excluded from that check, because it tracks the last published version and legitimately lags main.