release: bump 0.8.3 -> 0.8.4 (#256)

Version bump `0.8.3` → `0.8.4`.

Ships the work merged via #254:

### Fixed
- A single non-finite (NaN/inf) tick no longer poisons indicator state — 38 more scalar/pairwise indicators (linear-regression family, rolling quantiles/IQR, `Variance`/`StdDev`-derived stats, `Kurtosis`/`Skewness`, trailing stops, `KalmanHedgeRatio`, `SpreadBollingerBands`, …) now reject non-finite input and return `None`, joining the 16 pairwise indicators fixed earlier.

### Added
- Catalogue-wide property-based invariant harness (`crates/wickra-core/tests/invariants.rs`) asserting `batch == streaming`, `reset == fresh`, and non-finite-input rejection for every indicator and bar-builder.

### Changed
- CI: every job now has a runtime cap and the flaky Node test step auto-retries.
- Documentation accuracy fixes in `SECURITY.md`, `ARCHITECTURE.md`, and `THREAT_MODEL.md`.

Bump touches the manual release touchpoints only (`Cargo.toml`/`Cargo.lock`, Python/Node/Java/C#/R manifests, lockfiles, `SECURITY.md`, `CHANGELOG.md`). docs/webpage version strings are left to `sync-about.yml` on the tag.

bindings/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.",
   "author": "kingchenc <support@wickra.org>",
   "main": "index.js",
@@ -47,12 +47,12 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "wickra-linux-x64-gnu": "0.8.3",
-    "wickra-linux-arm64-gnu": "0.8.3",
-    "wickra-darwin-x64": "0.8.3",
-    "wickra-darwin-arm64": "0.8.3",
-    "wickra-win32-x64-msvc": "0.8.3",
-    "wickra-win32-arm64-msvc": "0.8.3"
+    "wickra-linux-x64-gnu": "0.8.4",
+    "wickra-linux-arm64-gnu": "0.8.4",
+    "wickra-darwin-x64": "0.8.4",
+    "wickra-darwin-arm64": "0.8.4",
+    "wickra-win32-x64-msvc": "0.8.4",
+    "wickra-win32-arm64-msvc": "0.8.4"
   },
   "scripts": {
     "build": "napi build --platform --release",