release: cut [Unreleased] → [v0.4.1] #212

Job	Run time
jscpd (duplication < 3% on touched code)	14s
OSV-Scanner (SCA)	7s
Semgrep (SAST)	29s
SBOM (SPDX + CycloneDX)	19s
Trivy (filesystem + container scan)	19s
Gitleaks (secret scan)	13s
	1m 41s

Provide feedback