v0.4.2

Dependency security release. No behavior changes and nothing to do
beyond upgrading.

An automated scan (#3) flagged the dependency tree. The vulnerability it
cited turned out not to apply, but govulncheck traced four others that
this code actually reaches: two in golang.org/x/net (an HTTP/2 infinite
loop and a punycode validation gap) and one each in golang.org/x/text
and google.golang.org/grpc, all reachable through the cloud sentinel's
probe client and the eviction webhook server. All three modules are now
past their fixed versions (x/net v0.58.0, x/text v0.41.0, grpc v1.83.1)
and govulncheck reports zero reachable vulnerabilities.

The release push itself is now scripted in hack/release.sh rather than
hand-run.

Upgrading:

helm upgrade understudy oci://ghcr.io/kylan11/charts/understudy \
  --namespace understudy-system

The image is built for arm64 and amd64.