release v4.1.0 -- platform release

The standardization spec for the nomograph estate. Pipeline graduates
from CI catalog to platform.

- Default platform policy applied uniformly via default block: retry,
  30m timeout, interruptible.
- Six universal gate components: hygiene, license-policy, readme-shape,
  release-discipline, registry-coherence, deps-scan.
- Ten language meta-components composing the universal gates with
  language-specific lint/test/publish: tool-rust, lib-rust, tree-sitter,
  grammar-rust, python-bench, python-lib, worker-ts, latex-template,
  data-only, go-tool.
- New container images: python, go-tool, worker-ts.
- Container builds and release tagging are decoupled. Container builds
  run only on Containerfile change / schedule / on-demand. Tag
  pipelines run a fast retag stage that re-tags :latest as :vN.M.P
  per container in ~30s each, ~5 min total.
- Pre-v4 components remain available for one release window.

v4.0.0 tag exists in history but never released cleanly. v4.1.0 ships
as the platform release; consumers should never pin to v4.0.0.

See CHANGELOG.md for the per-language migration recipe.