v4.1.0 🚀

Changes

⬆️ Upgrades

• Upgrade Elastic Stack 9.2.3 → 9.4.2 (Elasticsearch, Kibana, Logstash, APM Server, Beats).

🚀 Enhancements

• Adopt mise as the toolchain manager: pinned linters/formatters, one mise run check task, hk pre-commit hooks, and a GitHub Actions lint workflow.
• Port the stack commands (up, down, logs, certs, keystore, ...) to native mise tasks with service completion; the Makefile is now deprecated.
• Move Kibana xpack.*.encryptionKey values out of kibana.yml into ${KIBANA_*} env vars resolved from .env.
• Harden CI workflows: SHA-pinned actions, scoped permissions, persist-credentials: false, checkout v5.

🐛 Bug Fixes

• Fix Elasticsearch failing to start on rootless container backends (rootless podman). Rootless can't raise RLIMIT_MEMLOCK to the heap size, so the enforced bootstrap check died with exit 78. Heap locking is now opt-in via ELASTICSEARCH_MEMORY_LOCK (default false); set true on rootful Docker to keep mlockall.
• Silence non-fatal Elasticsearch 9.x entitlement WARNs (bundled repository-s3 plugin probing ~/.aws + EC2 metadata, and the x-pack config file watcher).

📝 Documentation

• Document the mise toolchain and updated workflow in README.md and AGENTS.md.

See #128 for the full diff.

---

_{🤖 Created with Claude Code (Opus 4.8) on behalf of @sherifabdlnaby}