v0.4.1

The first 0.4.x train stop for SP12 (ephemeral, agent-authored workflows). It lands
the two prerequisites that have no SP7 dependency — the authoring surface (SP12a)
and the provider registry (SP12d). Both are authoring/preflight primitives: they
let an agent write and check a workflow before any ephemeral run core exists. Nothing
in this release executes a workflow; that is SP12e (0.4.3).

Added

• Published workflow JSON Schema — schema/workflow.schema.json. The full
  workflow document is now described by a canonical JSON Schema, exposed to MCP
  clients as a resource at maestro://schema/workflow.json. An authoring agent can
  fetch the schema, generate a workflow against it, and validate locally before
  submission.
• maestro_validate_workflow MCP tool. Validates a workflow either inline (a
  JSON document passed directly) or from disk (a path), returning structured
  validation codes so an agent can run a repair loop. Bounded by a
  max_validate_attempts guard with an explicit recovery path.
• maestro_list_providers MCP tool + provider registry
  (src/provider-registry.mjs). Enumerates configured providers with capability
  flags (src/adapters/capabilities.mjs) and best-effort auth preflight, so an
  authoring agent can target only providers that are actually available. The
  registry/preflight primitives land here; the run-time enforcement of provider
  validation codes arrives with the ephemeral run core (SP12e).
• Exemplar workflow library — examples/. Canonical, schema-valid workflows an
  agent (or a human) can copy from: default, parallel-group, github-tracker,
  and full-audit-sweep.

Fixed

• herdr provider-alias resolution. Aliases (e.g. xcodex) are now resolved via
  bash -ic so the alias expands from the interactive shell; previously the runner
  exited 127 because the alias was not on PATH in a non-interactive shell.