v0.4.1 Same content as v0.4.0, released through a working pipeline. v0.4.0 published @dunn.dev/reference@0.4.0 to the registry and then failed at cosign, so it carries no signature, SBOM, attestation or Release page. Fixed in dunn.dev/pipeline 4.4.1: node-publish now signs to a Sigstore bundle rather than the sig+cert pair cosign 3.x rejects. Carries the 16-24px mark badge tier, the terminal-glyph recipe, checkable catalog-design principles, make check honouring .deviations.yaml, and the jq -er conflation fixes.