feat: advance login workflow and integration gates

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.4.0 — Advanced login workflow
+
+- Added account policy inspection for locked passwords, password expiry,
+  account expiry, inactivity, and missing shadow data without exposing hashes.
+- Added active UTMPX session discovery and systemd-logind capability detection
+  with an explicit UTMPX fallback.
+- Improved faillock parsing for legacy, username-prefixed, and timestamped
+  helper output. PAM remains authoritative for every login decision.
+- Added smart-case filtering for users and sessions, non-blocking Ctrl-R discovery
+  refresh, contextual footer hints, high-contrast mode, and policy notices in
+  the TUI.
+- Added bounded local authentication backoff after repeated failures and reset
+  it when switching accounts.
+- Added CLI integration tests and host capability probes. Docker now runs the
+  release binary through the safe CLI and capability suites.
+- Added documented strict VM validation for PAM policy, VT, X11, Wayland, and
+  systemd-logind; missing capabilities are reported as skips in ordinary CI.
+- Bumped the workspace release version to 0.4.0.
+
 ## 0.3.0 — Rust workspace release preparation
 
 - Rust is the supported login manager; the Go/cgo prototype is quarantined at