docs: write the v0.4.20 release notes

[roncodes]

Why CI failed

The Release Tag run on the #91 merge failed its notes validation:

RELEASE.md does not name v0.4.20 on its first line — it reads:
> v0.4.19 ~ "Marketplace storefronts with safer checkout and customer verification"

RELEASE.md still held the v0.4.19 notes — which is precisely the check that tells notes written for this release from the previous release's leftovers. No tag was pushed, so v0.4.20 does not exist yet.

What this PR does

Replaces RELEASE.md with notes for what actually shipped in v0.4.20 (#90, #92, #93, #94, #95), keeping the established structure:

• Security and Reliability — server-verified Stripe capture, serialized capture (409 on a concurrent attempt, existing order on a repeat), Customer-Token ownership on profile updates, the malformed QPay cancel/refund callback URL.
• API and Checkout Changes — the QPay callback now targets the registered capture-qpay route and carries the per-checkout URL, the 402/422/502 capture contract, cash pickup without a delivery quote, the persisted PaymentIntent, and the QPay token-caching / product-query wins.
• Upgrade Steps — the new checkouts.stripe_payment_intent_id migration, the core-api v1.6.60 floor (the QPay callback depends on the Utils::apiUrl query-string fix from Bugfix: Utils::apiUrl renders query params as path segments core-api#248), and the two client-facing contract changes: confirm the PaymentIntent before capture, and send Customer-Token when updating a customer.

Validation

Simulated the reusable workflow's three checks against this branch:

• first line contains v0.4.20 ✅ — > v0.4.20 ~ "Verified payments and gateway callbacks that arrive"
• no RELEASE_NOTES_PLACEHOLDER ✅
• composer.json, package.json, extension.json all read 0.4.20 ✅

After merge

This branch is not dev-v*, so merging it will not auto-trigger the tag workflow. Per the recovery path documented in .github/workflows/release.yml, tag it with a manual dispatch once this lands:

gh workflow run release.yml -R fleetbase/storefront -f version=0.4.20

Note that pushing v0.4.20 chains into create-release.yml and the npm/GitHub publish jobs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (57c63ef) to head (be455b1).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##                main       #96   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity      1775      1775           
===========================================
  Files            135       135           
  Lines           7785      7785           
===========================================
  Hits            7785      7785           

Flag	Coverage Δ
backend	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.