DvalinCode v0.4.1 — Local server hardening

Bugfix release for the local GUI binary.\n\nHighlights:\n- Hardened the local server boundary: loopback binding, browser origin checks, and workspace-root validation for WebSocket/REST cwd inputs.\n- Safer @file expansion using realpath workspace checks and .dvalincodeignore.\n- Release archives rebuilt from the patched source.\n- macOS archives now include a DvalinCode.app launcher with the project logo as the app icon, while keeping the original CLI binary for the installer.\n\nNote: Bun currently only supports Windows exe icon/metadata injection when compiling on Windows, so the cross-compiled Windows artifact is rebuilt but does not include an embedded exe icon.\n\nVerification:\n- npm run check: 10 test files, 56 tests passed.\n- SHA256SUMS.txt verified locally before upload.