release: cut [Unreleased] → [v0.4.1]

[aksOps]

Summary

Patch release. Move `[Unreleased]` under `[v0.4.1] - 2026-05-14` so the tag I'm about to push points at a commit that includes the changelog entry for itself.

What ships in v0.4.1

Pure CI / dependency hygiene — no codeiq pipeline or detector behavior changes since v0.4.0:

• PR chore(deps)(deps): bump github.com/spf13/pflag from 1.0.9 to 1.0.10 in the cobra-viper group #163 — `github.com/spf13/pflag` 1.0.9 → 1.0.10
• PR chore(actions)(deps): bump step-security/harden-runner from 2.19.1 to 2.19.2 in the actions group #164 — `step-security/harden-runner` 2.19.1 → 2.19.2
• PR fix(ci): widen release-darwin poll budget + early-bail on release-go failure #165 — `release-darwin` race fix (poll budget 90 s → 15 min, early-bail on `release-go` failure)

The race fix is the headline — every v0.x.y release going forward should now complete on the first try instead of needing a manual rerun of the darwin job.

Test plan

• No code touched; full suite already green on main.
• Functional verification fires when I push the `v0.4.1` tag after this lands: `release-go` + `release-darwin` should both succeed without manual intervention, validating fix(ci): widen release-darwin poll budget + early-bail on release-go failure #165.

🤖 Generated with Claude Code