release: cut [Unreleased] → [v0.4.1] (#167) #213

Job	Run time
OSV-Scanner (SCA)	7s
SBOM (SPDX + CycloneDX)	15s
Gitleaks (secret scan)	11s
jscpd (duplication < 3% on touched code)	20s
Trivy (filesystem + container scan)	14s
Semgrep (SAST)	25s
	1m 32s

Provide feedback