chore(release): prepare 0.4.11-a

[ZhuchkaTriplesix]

Summary

• pubspec.yaml → 0.4.11-a
• CHANGELOG section: security review (security(sandbox): handle OS sandbox unavailable on Windows and Linux (no bwrap) #395–security(sideload): optional SHA256 verification for local extension archive install #402) + Linux rpm/Flatpak/AUR (packaging(linux): distro packages (deb, rpm, Flatpak, optional AUR) #386)
• Roadmap + AUR PKGBUILD version bump

Part of shipping 0.4.11-a (patch after 0.4.11).

After merge

1. PR dev → main titled Release 0.4.11-a
2. Tag on main: git tag -a 0.4.11-a -m "Querya Desktop 0.4.11-a" && git push origin 0.4.11-a
3. Release workflow builds artifacts (incl. new .rpm / .flatpak)