chore: cut release v0.4.1

[REPPL]

Cuts release v0.4.1 (additive → patch, pre-1.0 per abcd's versioning policy). Merging this lands the dated CHANGELOG heading; auto-release.yml then tags the commit and release.yml runs the verify + receipt gate and publishes.

What ships in v0.4.1

The three grill-settled arcs merged this session (#156, #157, #158), plus the previously-unreleased work since v0.4.0:

• itd-103 — shell-hazard registry with an execution-time guard (abcd guard check / guard hook, fail-open-loud shim, ahoy health line).
• itd-104 — /abcd:ideate, the idea-admission gauntlet (three host legs, binary validates and records the verdict).
• itd-102 — abcd identity, one canonical identity block with a positioning check on every audit.
• Plus itd-100, itd-88, itd-94, itd-93, iss-75 and a batch of fixes (see the CHANGELOG entries).

How this was cut

• Ship-flow spec-close moved itd-102/103/104 to shipped and closed spc-16/18/19; the binary derived the version (v0.4.0 → v0.4.1) and the record set.
• The repo was still on hand-written [Unreleased] entries; a derived cut refuses a non-empty [Unreleased], so per the binary's one-time migration instruction the reviewed entries were rolled into ## [0.4.1] - 2026-07-28 with a fresh empty [Unreleased] above. The changelog prose came from the release-changelog-composer agent, bijection-verified against the record set.
• Surface-page links broken by spec-close were repointed (open→closed, planned→shipped).

Fidelity reviews (ship-flow receipts, ingested)

• itd-102 — 4/4 MET.
• itd-103 — 3 MET, 1 MET_WITH_CONCERNS (per-repo override honoured from the working tree before commit — tracked as iss-147).
• itd-104 — 3 MET, 1 MET_WITH_CONCERNS (the adversarial leg's fresh-context/off-policy property is prompt-enforced, not provable by the binary — consistent with the spec's host-delegated boundary).

Known gaps recorded, not hidden

• iss-151 (new) — itd-103 shipped only the guard plane; the teaching plane its press release promises (rules-loader safety domain) is unwired. All four itd-103 acceptance criteria concern the guard plane only, so the receipt is clean, but the headline is half-delivered.
• iss-147 — the guard's per-repo override is read from the working tree, so "committed-only" isn't yet enforced.
• itd-101 (citation gate) is not in this release — its branch is unmerged, blocked on a maintainer decision (confirm the one 403 citation, or disarm the baseline rule).

Gates: make preflight, docs lint and record-lint all green.