v0.4.1 — Critical bug fixes for v0.4.0

Patch release fixing two critical bugs found in v0.4.0 post-release code review.

Fixes

🔴 `lock_html` no longer drops runtime injection

When re-running `pagevault lock` on a file with existing `data-pv-v4` elements but a missing runtime, the runtime was being injected into the parsed DOM but then thrown away because the function returned the original input string. Re-locking could never repair a file that had lost its runtime — output was byte-identical to input.

Fix: `_inject_runtime` now returns whether it actually injected; `lock_html` returns the serialized soup if any mutation happened.

Regression test added.

🔴 `pagevault inspect` viewer list never shown

The viewer-detection regex in `inspect` matched v0.3.x dispatch shape (`'mime/type': __pv_viewer`), but v0.4.0 uses `window.__pv_viewers['mime/type'] = viewer`. The "Viewers:" line silently never printed.

Fix: regex updated to match v4 shape.

🟡 Format detection no longer misfires on stray script ids

`inspect` and `_find_first_envelope` previously detected wrap format by searching for `<script id="pv-meta">` anywhere in the document. A region-encrypted page containing plaintext that referenced `pv-meta` (e.g. example documentation) would be misclassified as wrap.

Fix: detect format via `` marker on the element instead.

Other improvements

10 small simplifications committed since v0.4.0 (pre-release): `_html_escape` replaced with stdlib `html.escape`, `encrypt_mode` deprecated param removed, lock-helper deduplication, json import hoisted, `_wrap_iife` extracted to share IIFE assembly between `build_region_js`/`build_wrap_js`, etc. Net -19 lines.

Upgrade

```bash
pip install --upgrade pagevault
```