fix(release): prepare verified v0.4.1 remediation

[DTALEX66]

Purpose

Create a clean, verified v0.4.1 release candidate to remediate the published v0.4.0 asset/checksum inventory mismatch. The existing v0.4.0 tag and Release are intentionally unchanged.

Changes

• propagate product version 0.4.1 through Python, runtime config, Tauri/Cargo/npm, installed lifecycle verifier, release injection, and source manifest
• regenerate uv.lock metadata and bind the manifest to its measured SHA-256
• add a current-version propagation gate; preserve historical v0.4.0 negative fixtures
• retain the fail-closed checksum payload allowlist and manifest/payload equality checks

Verified locally

• CI-equivalent Python suite: 1008 passed, 4 skipped
• A0/release contracts: 25 passed
• Chromium browser smoke; Ruff; JS syntax; repository convention and architecture guards; uv lock check
• Tauri library: 11 passed; installed backend lifecycle: 2 passed
• local NSIS bundle reached binary generation but its final makensis step is blocked by this workstation path length in bundled runtime; GitHub Windows CI/release workflow remains the authoritative clean-runner lifecycle verifier.

Release safety

• candidate base equals current origin/main at creation
• v0.4.1 tag and GitHub Release were confirmed absent before the branch was pushed
• artifact identity must still bind the future tag to merged main and checksum-bound allowlist assets.