v1.4.0 — Hosted-app writable-data-path contract + INSTALL.md §5.6 correction

The #322 production-unblock release. Resolves the Collabhost-side model and the documentation/contract root cause of the S24→S26 hosted-app rollback class.

Operator-facing changes

• New: writableDataPath contract. Registration (POST /api/v1/apps) and GET /api/v1/apps/{slug}, plus MCP register_app/get_app, now return the platform-provisioned per-app writable path (${COLLABHOST_DATA_PATH}/app-data/<slug>, absolute, inside the service's ReadWritePaths). A hosted app that writes to disk should be configured to write there.
• Fixed: INSTALL.md §5.6. No longer recommends the /srv/<slug>/data/ layout — that path is read-only under the hardened system-scope unit and was the documentation root cause of three consecutive production rollbacks. §5.6 now separates the read-only artifact tree from the platform writable path, with a worked example.
• Removed: silent cwd-redirect workaround (Axis B). Hosted dotnet-apps are no longer silently cwd-redirected; the supervisor uses the artifact location, and apps are configured explicitly via the contract above. Bundle-dir provisioning (CH-C) now fires only for apps that actually self-extract (closes a mis-provisioning case).
• Internal: standard hosting/service model + cross-project coordination protocol committed to project governance.

Scope (honest)

This resolves the Collabhost-side model and the doc/contract root cause. End-to-end production hosting of Collaboard also depends on Collaboard-side fixes (its documented config-override and data-path resolver) tracked separately — this release alone does not confirm Collaboard hosts cleanly.

Upgrade

BC-clean: additive contract, no schema/migration/installer/unit change. Existing v1.3.x installs upgrade without operator intervention.