CD v0.4.1: patched toolchain and verified transfer flows

Stabilizes the CLI release and verification pipeline.

• Rebuilt with Go 1.26.10 and golang.org/x/net 0.60.0 to address called vulnerability findings.
• Update failures retain their actual API error instead of reporting every failure as an unreachable GitHub server.
• Stable cdx and cdx-nightly remain separate; failed checksum verification preserves both installed binaries.
• Includes the relay admission deadline fix and terminal progress redraw fix from v0.4.0.

Validation: 122 JavaScript tests, Go race tests, typechecking, browser and CLI integration checks, 10 transport cases with 64 MiB payloads, deployment dry run, live stable/nightly installation and update, and a 645 MiB production relay transfer with matching hashes. PowerShell runtime testing is unavailable locally.

PR: #90

Security verification: no called vulnerabilities found, no dependency audit findings, and the full 578-commit secret scan passes. Secret-scan exceptions match only proven public test vectors and a historical source checksum; synthetic new secrets remain detectable.