release(sdk): @klickd/core 4.1.0 + klickd 4.1.0

[Davincc77]

Summary

Release-prep PR that bumps both reference SDKs to 4.1.0 in lock-step and documents the release. No publish, tag, or GitHub Release is performed by this PR — those are manual, post-merge workflow_dispatch steps.

• npm @klickd/core 4.0.3 → 4.1.0 (packages/@klickd/core/package.json)
• PyPI klickd 4.0.3 → 4.1.0 (packages/pypi/klickd/pyproject.toml + klickd.__version__)
• publish-npm.yml default expected_version aligned to 4.1.0 (OIDC Trusted Publishing binding, workflow file path, and pre-publish guards unchanged)
• CHANGELOG.md new packaging 4.1.0 — 2026-05-30 entry; README.md SDK track line updated to 4.1.0
• The v4.1 candidate / benchmark / evidence (Zenodo DOI) track is referenced for provenance only

Boundaries preserved

• v4.0.0 GA wire envelope, JSON schemas, payload semantics, and the four starter .klickd files are byte-unchanged
• No benchmark result-data or DOI evidence-pack modified
• No internal working-codename string introduced on any public surface
• Claim boundary intact: no universal native support, no automatic GDPR/EU AI Act compliance, no external benchmark superiority; v4.1 candidate track is not GA
• Root workspace version (4.0.0, private/unpublished) and the legacy pinned publish workflows are intentionally left unchanged

Testing

• npm @klickd/core: npm test — 101 passed (Jest, 5 suites)
• npm @klickd/core: npm run build — ESM + CJS + DTS build success
• npm @klickd/core: npm run verify:tarball — CJS + ESM smoke OK (packs klickd-core-4.1.0.tgz)
• npm @klickd/core: npm pack --dry-run — all 4 starter skills present, version 4.1.0
• PyPI klickd: pytest tests/ — 102 passed, 1 skipped
• PyPI klickd: python -m build — built klickd-4.1.0 sdist + wheel; wheel Version: 4.1.0, 4 schemas + 6 starter-skill files included; klickd.__version__ == "4.1.0"
• Cross-impl vectors: node verify_vectors.mjs 47/47 (13 skipped, hash-wasm not installed locally); python verify_vectors.py 77/77
• Schema/validators: validate_v4_schemas.py OK; validate_v4_1_candidate_mapping.py OK (42 artefacts); validate_starter_packs.py (no packs/starter dir — N/A in this layout)

Optional-dep notes

• Local Node is 20.20.1 (engines >=18 satisfied); the publish workflow pins Node 24.
• hash-wasm not installed locally → 13 JS vector cases skipped (CI installs it).
• Python argon2-cffi + jcs were installed locally to run the suite; both are declared runtime deps.

🤖 Generated with Claude Code