[zongqichen]

Why

The fixes and security updates since v0.4.0 need versioned release notes and validated distribution archives. Prepare v0.4.1 as the next patch release.

What changed

• Move the existing changelog entries into the v0.4.1 section.
• Keep an empty Unreleased section and update the comparison links.

Scope

This PR prepares the changelog and validates local snapshot packages. Creating the tag and publishing the release require separate maintainer authorization.

Blast Radius

The source diff only changes the changelog distributed with the CLI. Runtime code and release workflow guards are unchanged.

Verification

• make check, make security, make release-check, make smoke, and make e2e passed.
• GoReleaser v2.18.2 built all four supported archives with Go 1.27.3. Exact contents, ownership, permissions, timestamps, and checksums passed the package check.
• Local snapshot binaries contain the expected version and commit. The Linux amd64 archive binary passed version and help checks.

Closes #64.

[zongqichen]

Independent release-candidate verification for Issue 64: PASS.

I verified exact head 868cb079feb116738027f7287159ea747e0c603c against
base ec98e322e84ccbd9634283f3364c12201efd2c25. The source diff is limited to
the 0.4.1 changelog promotion and comparison links. No local or remote
v0.4.1 tag exists.

All four candidate archive hashes match checksums.txt. Their contents,
ownership, modes, timestamps, source documents, target metadata, Go 1.27.3
compiler metadata, commit, and 0.4.1-SNAPSHOT-868cb07 version passed direct
inspection. The extracted Linux amd64 binary passed an isolated user flow,
probe-doctor.py --expect-fixed, and probe-seed-race.py. The doctor probe made
zero API requests, and the race probe preserved the concurrent workspace
configuration.

Checksums and full evidence are in unit-7/verification.md. I did not rebuild,
publish, tag, modify GitHub, or touch a real user Cloud Foundry configuration.