[obasilakis]

Summary

Sets VERSION and the DigitalOcean create script's default image tag to 1.0.0-rc4, ahead of tagging v1.0.0-rc4 on dev.

• VERSION: 1.0.0-rc3 → 1.0.0-rc4
• scripts/deploy/trinity-do-create.sh: TRINITY_IMAGE_TAG default v1.0.0-rc3 → v1.0.0-rc4 (pinned to VERSION by tests/unit/test_2380_installer_release_pin.py)

Release-candidate scope

• The tag goes on the dev tip after this merges. main is untouched and there is no release PR.
• No issues are closed and no status-in-dev labels change.
• publish-images.yml publishes v1.0.0-rc4 and 1.0.0-rc4 to GHCR. latest stays where it is: the type=raw,value=latest entry carries !contains(github.ref_name, '-').

Pre-release checks

• 24 commits on dev since v1.0.0-rc3.
• No open P0 outside status-in-dev.
• Secrets scan over v1.0.0-rc3..dev: clean.
• Enterprise submodule pin 6501fb1 equals enterprise main; no pointer bump needed.

Test plan

• tests/unit/test_2380_installer_release_pin.py: 2 passed

🤖 Generated with Claude Code

[dolho]

LGTM. Two-line rc bump, same shape as the rc3 bump (#3650): VERSION and the trinity-do-create.sh default tag move together, which keeps test_2380_installer_release_pin.py green. dev is at 1.0.0-rc3 and no v1.0.0-rc4 tag exists yet.