v4.1.1

• task --update replaces the binary with a published release — the latest,
  or --update=<version> for a specific one. It asks before touching anything
  (--yes skips that), checks the download against the sha256 published
  beside it, and runs the new binary to confirm it works here before putting it
  in place.
  task --update --check only reports what is available, exiting 1 when a
  newer release exists. A task named update still runs as it always did.
• install-task.sh installs again — every run used to fail before it
  downloaded the archive.
• A failing cache registry or cache lock names the reason — a rejected
  certificate, a refused connection, a name that does not resolve — instead of
  only reporting that the registry could not be reached.
• A vks:// lock trusts the same certificate as the cache, so one registry
  behind a private CA serves both the cache and the build-once lock. Such a lock
  could not connect before, and every run took a local lock instead.
• Go-syntax Taskfiles can call printf and print, so a Taskfile that
  builds a path out of several variables renders and migrates instead of being
  rejected as an unsupported construct. printf covers the string-composing
  verbs (%s, %v, %q, %d, %%, with flags and a width); another verb, a
  precision, an argument its verb cannot render, or a mismatched argument count
  is an error.
• An unsupported Go construct is reported as the {{ … }} that used it —
  with the line it is on when migrating a whole Taskfile — instead of quoting
  the string it came from, which under --migrate was the whole file.