v0.4.1

Same content as v0.4.0, released through a working pipeline. v0.4.0
published @dunn.dev/reference@0.4.0 to the registry and then failed at
cosign, so it carries no signature, SBOM, attestation or Release page.
Fixed in dunn.dev/pipeline 4.4.1: node-publish now signs to a Sigstore
bundle rather than the sig+cert pair cosign 3.x rejects.

Carries the 16-24px mark badge tier, the terminal-glyph recipe,
checkable catalog-design principles, make check honouring
.deviations.yaml, and the jq -er conflation fixes.