v2.4.1

What's Changed

• docs: record v2.4.0 release evidence by @SimonAKing in #189
• ci: verify published installer lifecycle by @SimonAKing in #191
• fix: compare Debian package versions correctly by @SimonAKing in #192
• docs: record installer lifecycle evidence by @SimonAKing in #193
• test: cover tagged beta config migrations by @SimonAKing in #194
• ci: launch installed renderer in lifecycle smoke by @SimonAKing in #195
• docs: record installed GUI startup evidence by @SimonAKing in #196
• docs: audit M0 through M4 completion evidence by @SimonAKing in #197
• test: add redacted physical hardware preflight by @SimonAKing in #198
• security: add CodeQL and release provenance by @SimonAKing in #199
• security: remediate CodeQL file handling alerts by @SimonAKing in #200
• release: prepare GPL v2.4.1 security patch by @SimonAKing in #201
• fix: select gzip mode for streamed tar bundles by @SimonAKing in #202
• fix: extract verified Windows bundles in memory by @SimonAKing in #203

Full Changelog: v2.4.0...v2.4.1