AGT v4.0.0 released — flip git pin in Cargo.toml + revendor SDK

AGT upstream just released **v4.0.0**, which contains the
commit our `[patch.crates-io]` pin currently overrides:

- Pinned commit: `bae5de307731c399d9121489c4597577f120d040`
- Released tag: `v4.0.0`

The git override in `Cargo.toml` can now be removed. To-do:

### Rust side
1. `Cargo.toml` — set `agentmesh` and `agentmesh-mcp` to the released
version (`v4.0.0` without the `v` prefix)
2. Delete the `[patch.crates-io]` block at the bottom of `Cargo.toml`
3. `cargo update -p agentmesh -p agentmesh-mcp`
4. `cargo check --workspace` to verify

### npm side
1. Rebuild and revendor the AGT TypeScript SDK from upstream
v4.0.0 (run `scripts/vendor-agt-sdk.sh` once we add it,
or manually clone + npm pack + commit the tarball)
2. Or, if the released npm `@microsoft/agent-governance-sdk@v4.0.0`
now contains the fix, switch `mesh-plugin/package.json` and
`runtimes/openclaw/package.json` back to the published version
and remove `vendor/agt/` entirely

### Auto-filed by
`.github/workflows/check-agt-released.yml` on 2026-06-02

Start with Cargo.toml: update agentmesh and agentmesh-mcp to 4.0.0, remove the [patch.crates-io] block, run cargo update -p agentmesh -p agentmesh-mcp, and verify with cargo check --workspace. Then inspect mesh-plugin/package.json, runtimes/openclaw/package.json, and vendor/agt/ to choose between revendor­ing the upstream TypeScript SDK and using the published npm package. Done means the Rust and npm dependencies use AGT v4.0.0 and workspace checks pass.

Written by the indexing model from the issue text.