Record 0.4.1 publication and public verification

[BitL8-ByteShort]

Changes

• Record published npm 0.4.1 and immutable GitHub v0.4.1 in the README, support matrix, and package ledger.
• Preserve a redacted public verification receipt for both channels, including download digests, exact installed-package acceptance, release/tag identity, and the clean version-pinned npm install.
• Keep the tested release artifact bound to source commit 306caba5dc6d000fd19d694c8e497f59acfd49f0. This documentation update does not rebuild the published tarball.

Verification

• Credential-free npm and GitHub downloads are byte-identical to the single final CI tarball: SHA-256 9a04514bc7bf2ab251b027f9da18b03a3f8d786c84f95d8b4245e645a12bd2e5.
• npm registry SHA-512 integrity matches, and latest points to 0.4.1.
• Each public download passed all 18 package checks, both OpenCode hosts (20 scenarios and 57 synthetic loopback requests each), and all 14 production browser scenarios on Linux x64 / Node 24.21.0. Zero browser failures, skips, or flakes; zero real-provider inference.
• A clean version-pinned npm name install reported CLI 0.4.1 and matched all 84 package files.
• GitHub v0.4.1 is immutable; its tag points to the reviewed artifact source commit. All five downloaded draft assets matched their staged files before publication.
• JSON receipts and whitespace checks passed; receipts contain no credentials, prompts, attachments, or private launch URLs.

Release: https://github.com/BitL8-ByteShort/opencode-model-control/releases/tag/v0.4.1