chore: release dds 0.4.0 - #31

* ci: release on every push to main through changesets/action

Until now release.yml only ran when someone pushed a `dds-v*` tag by
hand. Nothing created that tag: two release commits (0.4.0 in #31,
0.4.1 in #33) sat on main while npm stayed at 0.3.0, and the landing
that was waiting on site-kit 0.4.1 shipped behind a `<select>` instead
of the flag picker.

The workflow now runs on every push to main, passes the same
verification gate as before, and hands off to changesets/action: with
changeset files waiting it opens the "chore: release dds" version PR;
with none waiting (the version PR just merged) it runs `changeset
publish`, which publishes whatever is on main but not yet on npm and
tags each package. Re-runs are safe because versions already on npm are
skipped. Provenance and the NPM_TOKEN secret are unchanged. The README
pair describes the flow.

* ci: let the release verifiers pass when the version is already on npm

verify:solid:release and verify:site-kit:release end with
`npm publish --dry-run`, and npm refuses a dry-run of a version that is
already published. That made CI on main red from the moment a release
went out until the next version bump — exactly the state the new
release workflow runs in on every push. The pack, the manifest and the
fresh-consumer install are what these gates check; an "already
published" answer from the registry is now logged and counted as
passed, and every other dry-run failure still throws. verify:release
never hit this because it runs npm offline.