v0.4.1

chore: release v0.4.1

Bug fixes:
- Every agent dispatches by default. action-validator.ts default flips to
  return true (was: only personas with type "lead"). Per-persona opt-out
  via canDispatch:false in YAML still honored. canDispatch:true also
  added explicitly to all 42 library persona YAMLs as belt-and-suspenders.
- Home screen renders all 9 quick-action chips on agent-less installs.
  Drops the preferredAgents-based filter; runQuickAction picks dispatcher
  via simple priority: user-selected → editor (if installed) → first
  installed agent → composer.submit fallback.
- Home composer gains an AgentPicker dropdown next to the model picker,
  with an "Auto" sentinel that defers to the cascade. Selected agent
  overrides any chip's preferredAgents and the free-form composer.submit
  default routing.
- /api/cabinets/overview 404 no longer surfaces as a console error every
  refresh tick. fetchCabinetOverviewClient returns null on 404 and caches
  it longer than the success TTL. All 9 callsites updated to handle the
  new nullable return.
- Onboarding dictionary entries (1, 2, 3) revert from font-body-serif
  (Source Serif 4 → Georgia fallback) to inherited Inter sans-serif.

Release plumbing:
- npm publish via OIDC trusted publishing (no NODE_AUTH_TOKEN).
  Requires npmjs.com Trusted Publishers config for cabinetai and
  create-cabinet pointing at hilash/cabinet workflow release.yml.

Versions:
- root, cabinetai, create-cabinet bumped to 0.4.1.
- create-cabinet pins cabinetai to exactly 0.4.1.