Record verified 0.4.1 final artifact evidence

[BitL8-ByteShort]

Outcome

Record the exact 0.4.1 final artifact in the support matrix and package ledger: source commit, SHA-256, executed runtimes, and actual check counts. Final CI passed all seven jobs, and the GitHub draft's four downloaded assets match the staged files byte for byte.

This documentation commit does not rebuild the release artifact. The docs explicitly separate final-artifact acceptance from npm/GitHub publication and public-download verification. npm authentication is still required; 0.4.1 is staged as a draft.

Verification

• Final CI run 36647447813: source verification under Node 22.12.0 and 24.x, pack, and all four installed-package jobs passed.
• Downloaded evidence binds all four jobs to the same SHA-256. Each passed 18 package checks, both supported hosts (20 scenarios and 57 loopback requests each), and 14 production browser scenarios with zero skips or flakes. Zero real-provider inference requests.
• The negative artifact checks detected both intentionally corrupted artifacts.
• Fresh npm run verify with isolated OpenCode 1.18.22: 354 tests, zero skips, type checking and build passed.
• git diff --check passed. Commit has a DCO sign-off.

Safety and compatibility

Documentation only. No runtime, settings, configuration, dependency, or release bytes change. No publication or public-download claim is made.