Move to core v0.19.4 and release #980

Objective

Move this repo to the current fleet floor and release it:

• core v0.19.4;
• sdk-go v0.4.0 and sdk-go/workcontext v0.1.0, wherever either is required;
• saas-sdk-go v0.1.2, wherever it is required.

This is wave 2 of the fleet move to one current core (wave 1, the libraries, is released). It is one PR.

State on main (5e06a0b)

go.mod on core v0.19.2 and LISTS sigs.k8s.io/kustomize/api v0.21.3 — v0.19.2 is one of the two core releases whose kustomize pulls structured-merge-diff/v7 and breaks every build that compiles client-go; also pins sdk-go/workcontext at a pseudo-version (move to the v0.1.0 tag). Open PR #931 (core v0.16.0) is superseded by this — close it with a pointer here once this merges.

Done when

• Every go.mod that requires core is on v0.19.4, from released tags only: no replace and no codefly pseudo-version.
• No structured-merge-diff/v7. go mod graph | grep structured-merge-diff/v7 prints nothing in every module. Core v0.19.2 and v0.19.3 pulled kustomize v0.21.3, whose kube-openapi is on structured-merge-diff/v7 and breaks any build that compiles client-go. Go never lowers a version go.mod already lists, so if a go.mod lists kustomize v0.21.3 or kube-openapi 97fa35140926, run:
  go get sigs.k8s.io/kustomize/api@v0.21.1 sigs.k8s.io/kustomize/kyaml@v0.21.1 k8s.io/kube-openapi@v0.0.0-20260721132016-d427ff9ee9ad
• Go directive. Core v0.19.4's go directive may raise this repo's. Follow every exact Go pin that has to move with it: CI go-version, runtime/builder images, toolchain files.
• Green. Build, vet, tests and lint pass locally and in CI.
• Contract changes are adapted, not shimmed. Where core's API moved between this repo's old pin and v0.19.4, adapt at the call site. Anything labelled legacy is deleted, not fenced.
• Docs. The PR updates any doc that states the old pins.
• PR body. It names what was reused and classifies every change as a fix or a hack.

Release

After an independent review and merge, release by this repo's own procedure (release.yaml / publish-agent.yml (codefly publish; never hand-tag)). Never hand-tag a repo whose procedure is codefly publish or a release workflow.

Out of scope

Any behaviour change beyond what the core move forces.