v0.4.1

Security

• Upgraded golang.org/x/text to v0.39.0 to remediate reachable
  GO-2026-5970. Because v0.4.0 was already published, the remediation ships in
  v0.4.1.
• Release automation now requires a GitHub-verified signed annotated tag whose
  version matches package.json, an exact literal changelog heading, and the
  freshly fetched origin/main commit; complete CI/vulnerability and real-DB
  gates rerun on that tag commit before publication can start.
• MySQL and PostgreSQL integration images are pinned to the digests exercised
  by the successful v0.4.0 release run, and CI now fails rather than silently
  skipping the real-database suite when a required endpoint is missing.

Fixed

• Release checksum aggregation now merges matrix artifacts without Unix
  binary/directory name collisions, verifies all six per-platform checksum
  files, and fails unless the global manifest contains exactly six binaries.