v0.4.1

A patch for one wrong number: the lockfile shipped in 0.4.0 still said 0.3.2. The version bump reached package.json and not package-lock.json.

npm ci never noticed — it validates the dependency tree, not this field, and installs cleanly — so nothing was broken. But a release whose notes ask people to read carefully before upgrading should not also carry a file stating the wrong version of itself.

test/invariants.mjs now asserts that both places inside the lockfile agree with package.json, so the next bump that misses one fails there instead of on this page.

No code changes. If you are already on 0.4.0, there is nothing here you need.