hakurei 0.4.0

Migration:
The `cmd/hakurei` command `app`, for starting containers from a configuration
file, has been renamed to `run`. Additionally, `dist/release.sh` has been
renamed to `all.sh`, however usage remains identical.

API Changes:
- Remove compatibility wrappers for all deprecated APIs.
- Package `ext` renamed from `container/std`.
- Rename `ScmpSyscall` to `SyscallNum`.
- Package `vfs` renamed from `container/vfs`.
- Package `check` renamed from `container/check`.
- Move syscall wrappers to package `ext`.
- Package `fhs` renamed from `container/fhs`.
- Move package `container/stub` internal.
- Command `run` renamed to `exec`, and `app` to `run` in `cmd/hakurei`.
- Remove setup helpers from package `container`.
- Optionally reject insecure options in package `hst`.
- Remove explicit enablements JSON adapter in package `hst`.
- Unexport `PR_SET_NO_NEW_PRIVS` wrapper in package `container`.
- Move landlock internal from package `container`.

Fixes:
- Correctly describe `--with-toolchain` in `cmd/mbf`.
- Use `filepath` in portable packages.
- Ignore finished process in container init.
- Optionally skip landlock on hostnet in package `container`.
- Group-accessible permission bits in `cmd/sharefs` to work around vfs inode
  file attribute race.

Enhancements:
- C integer limit values in package `ext`.
- Optionally set `FD_CLOEXEC` via `close_range` (build tag: `close_range`).
- Optionally suppress via assumed checksum in package `internal/pkg`.
- Release script `dist/release.sh` replaced by `cmd/dist`.
- Prefix configurable from environment via `cmd/dist`.
- Conditionally skip root remount in package `hst`.
- Add riscv64 stage0 tarball for Rosa OS.
- Optionally transparently degrade in test suite.

Internal:
- Generic netlink implementation in package `internal/netlink`.
- Kobject uevent (with coldboot) implementation in package `internal/uevent`.
- Export container params of `KindExec` and `KindExecNet` in package
  `internal/pkg`.
- Move collection helper-artifact to package `internal/pkg`.
- Retain session by default in `cmd/mbf`.
- Alternative hsurc path for Rosa OS.
- Cache now accepts flags in package `internal/pkg`.
-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAg/+8EpV0uLIR+MAtm7kYw4ssYDi
TAEe6cY2wdrwBLU38AAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
AAAAQIhEelFdFHG92dDL1wW6QoFmrj0v9F52jPPA66lexegdQLnEA7HtVcQQNUJ4PRG5S5
d3pkC1eE0L9K4KDnQicAY=
-----END SSH SIGNATURE-----