OpenReceive v0.4.1

Tooling-only release: no package or gem changes its public API. It exists to
exercise the new gem publishing path end to end. The four Buy a Button examples
resolve the workspace packages by path and run 0.4.1; the live wallet smoke was
skipped.

Gems publish from CI without an OTP

.github/workflows/publish-gems.yml pushes openreceive, openreceive-server
and openreceive-rails on every v* tag through RubyGems Trusted Publishing:
the job trades a GitHub OIDC token for a 15-minute push-only key, so no
RubyGems credential is stored and no TOTP code is typed (a trusted-publisher key
satisfies rubygems_mfa_required). The rubygems GitHub environment gates the
job behind a required approval and admits only v* tags. check:workflows now
allows gem push in that one workflow and pins its environment, permissions
and container; the placeholder publish.yml is gone. tools/release/push-gems.sh
remains the manual, OTP-per-gem fallback.

Publishing trusts green CI

npm run release:publish no longer re-runs npm run test:ci when the CI and
Release Dry Run workflows are both green on the exact commit being published.
The 0.4.0 release ran the suite twice back to back on the same commit — once in
the tag's dry run, once locally — for no extra evidence. To make the pair a
faithful stand-in, release.yml gained the four test:ci steps that only the
weekly Demos lane used to run (check:demo-containers, the Rails example's
catalog check, build:demo, scan:client-bundles), and check:workflows pins
them. Without a green pair (no gh, a missing, failed or in-progress run, a
dirty worktree) the suite runs locally as before; --skip-tests still skips it
unconditionally.