* chore(release): v0.4.1

Hygiene release. Bumps version 0.4.0 → 0.4.1 and promotes the [Unreleased]
section to a dated [0.4.1] entry. Substance was already on main from session 43:
truthbase + claims-alignment CI guard (closes the hero 374→413 drift class),
focus-trap on dashboard modals, useApiData stale-resolve race fix, CustomRuleStore
tenant-aware API (cloud-tier groundwork), CORS allowlist hardening, DNS
pre-resolve guard against citation-verify SSRF, tenant gate on /rules/custom.

Bundles 5 dependency bumps merged this session: safe-regex2 5.1.0→5.1.1 (#101),
express-rate-limit 8.3.2→8.5.0 (#126), anchore/sbom-action 0.9.0→0.24.0 (#127),
testing-group bump (#110), linting-group bump (#107).

Two workflow-scope dep bumps deferred to v0.4.2: sigstore/cosign-installer
3.9.2→4.1.1 (#125, MAJOR — wants pre-merge signing verification anyway),
github-actions group (#106). Both blocked locally on `gh auth refresh -s workflow`.

No breaking changes for OSS deployments. .claims.json regenerated; CI
claims-alignment gate green locally (claims:check OK).

* chore(release): sync ancillary version surfaces to 0.4.1

Caught by check-version.sh CI gate: server.json (MCP Registry manifest),
website/public/.well-known/mcp.json (public MCP descriptor), and
.claude-plugin/plugin.json all need to track package.json. Generated by
node scripts/sync-versions.mjs.