chore(release): 1.4.0 + harden the no-cloud boundary guard

[andrei-hasna]

Follow-up to #333. That PR was merged while I was still pushing to the branch, so main carries the cloud removal but not these two commits. Without them main's package.json still says 1.3.46, which is already on npm — publishing would conflict.

1. chore(release): 1.4.0

Minor rather than patch, because #333 removed public surface: the whole connectors cloud command group and 4 cloud MCP tools. This matches the repo's existing convention of taking a minor for removals (0.2.9 -> 0.3.0 removed the MCP .describe() surface). Adds the missing ## [1.4.0] CHANGELOG section with a ### Removed entry, so anyone scripting connectors cloud sync push gets a release note for the break instead of a silent failure.

2. test(no-cloud): widen the boundary guard

Adversarial review found the guard shipped in #333 much weaker than its own commit message claimed — 12 of 14 bypass attempts passed clean. It only matched a from "..." specifier, in six extensions, directly under src/, and skipped any directory basenamed bin or dist at any depth.

The gap that actually mattered: connectors/ and dashboard/dist/ are both published via package.json files. A vendored connector could have reintroduced @hasna/cloud and shipped it to every machine in the fleet without tripping anything.

• Scan roots now derive from package.json files, plus src, scripts, sdk. Driving it off files means a newly shipped directory is covered automatically rather than silently escaping the guard.
• SKIP_DIRS reduced to node_modules and .git, so src/bin/ and src/dist/ are no longer holes.
• Added mts/cts.
• The specifier pattern now also matches a bare import "pkg" with no from.
• The manifest check covers every field that can pull a package into an install (bundleDependencies, bundledDependencies, overrides, resolutions, trustedDependencies alongside the original four) and runs over every package.json in the shipped tree, not just the root.
• Added a lockfile assertion.

Re-planting every bypass: 20 caught, 0 bypassed. Scan covers ~14k shipped source files and ~1.2k manifests in ~3.7s.

Verification

bun run typecheck -> exit 0
bun run build     -> exit 0
bun test          -> exit 0, 3969 pass / 0 fail

Refs: todos be07a270

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}