AGT v4.0.0 released — flip git pin in Cargo.toml + revendor SDK

[github-actions]

AGT upstream just released v4.0.0, which contains the
commit our [patch.crates-io] pin currently overrides:

• Pinned commit: bae5de307731c399d9121489c4597577f120d040
• Released tag: v4.0.0

The git override in Cargo.toml can now be removed. To-do:

Rust side

1. Cargo.toml — set agentmesh and agentmesh-mcp to the released
   version (v4.0.0 without the v prefix)
2. Delete the [patch.crates-io] block at the bottom of Cargo.toml
3. cargo update -p agentmesh -p agentmesh-mcp
4. cargo check --workspace to verify

npm side

1. Rebuild and revendor the AGT TypeScript SDK from upstream
   v4.0.0 (run scripts/vendor-agt-sdk.sh once we add it,
   or manually clone + npm pack + commit the tarball)
2. Or, if the released npm @microsoft/agent-governance-sdk@v4.0.0
   now contains the fix, switch mesh-plugin/package.json and
   runtimes/openclaw/package.json back to the published version
   and remove vendor/agt/ entirely

Auto-filed by

.github/workflows/check-agt-released.yml on 2026-06-02