chore(hoolicy): recover unpublished release preparation

CHANGELOG.md

@@ -1,15 +1,5 @@
 # Changelog
 
-## 0.4.1 (2026-10-03)
-
-### Bug Fixes
-
-- **hoolicy:** harden policy evaluation and polish CLI workflows (#35) (13b8f61)
-
-### Other Changes
-
-- **hoolicy:** add contributor and user agent skills (#34) (95fa1e8)
-
 ## 0.4.0 (2026-09-22)
 
 ### Features

README.md

@@ -37,8 +37,8 @@ For unpublished changes, pass the local checkout path instead of
 Install a release binary, use the container, or build with Go 1.26+:
 
 ```sh
-go install github.com/openhoo/hoolicy/cmd/hoolicy@v0.4.1
-# or: docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/work:ro" -w /work ghcr.io/openhoo/hoolicy:v0.4.1 check
+go install github.com/openhoo/hoolicy/cmd/hoolicy@v0.4.0
+# or: docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/work:ro" -w /work ghcr.io/openhoo/hoolicy:v0.4.0 check
 ```
 
 For rootless Podman, add `--userns=keep-id`. Mapping the caller UID lets the non-root image read private repository files without weakening their host permissions.
@@ -149,7 +149,7 @@ Use this repository as a versioned remote pack source:
 packs:
   - name: repository
     git: https://github.com/openhoo/hoolicy.git
-    ref: v0.4.1
+    ref: v0.4.0
     subdir: packs/repository
     with:
       branch_pattern: '^(feat|fix|chore)/[a-z0-9]+(?:-[a-z0-9]+)*$'
@@ -179,4 +179,12 @@ Latest published release remains the version in `VERSION`. Current development s
 
 Commits use Conventional Commits and are checked by Hooversion. After successful CI on protected `main`, Hooversion prepares the next release on a release branch and reports a protected release PR; review and merge that PR rather than recreating the release commit manually. The merge's successful CI finalizes the release commit and immutable tag, then the release workflow attaches signed binaries, an SPDX SBOM, provenance, and a signed multi-platform GHCR image. `feat` commits publish a minor release, `fix` and `perf` commits publish a patch release, and breaking changes publish a major release; non-release commits do not publish a version.
 
+When squash-merging a prepared release PR, preserve the generated commit's
+subject and body exactly, including the package name in
+`chore(release): hoolicy <version>` and its generated release notes. Supply both
+explicitly when merging; a replacement PR description, co-author trailer, or
+pull-request number suffix can prevent the pinned Hooversion version from
+recognizing the prepared release. Verify the merged message against the prepared
+commit before relying on finalization.
+
 Apache-2.0. See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).

VERSION

@@ -1 +1 @@
-0.4.1
+0.4.0

actions/README.md

@@ -5,7 +5,7 @@ Use immutable action revisions in consuming repositories.
 ```yaml
 - uses: openhoo/hoolicy/actions/check@<full-commit-sha>
   with:
-    version: 0.4.1
+    version: 0.4.0
 ```
 
 `actions/setup` installs a pinned Cosign verifier, downloads the release archive,

actions/check/action.yml

@@ -4,7 +4,7 @@ inputs:
   version:
     description: Hoolicy release version to install.
     required: false
-    default: "0.4.1"
+    default: "0.4.0"
   executable:
     description: Optional Hoolicy executable path; skips release installation when set.
     required: false

actions/setup/action.yml

@@ -4,7 +4,7 @@ inputs:
   version:
     description: Hoolicy release version to install.
     required: false
-    default: "0.4.1"
+    default: "0.4.0"
 outputs:
   version:
     description: Hoolicy version configured by this action.