chore(release): v0.4.1, and stop every release needing hand edits

[SecretLUL]

Two commits: the v0.4.1 version bump, and the reason a bump needs its own pull request at all.

chore(release): v0.4.1

Raises the version across Cargo.toml, Cargo.lock and the issue template, and adds docs/release-notes/v0.4.1.md covering #50 and #49.

chore(release): stop the README repeating the version, script the bump PR

The README no longer states a version. Its checksum example named winmedic-v<version>.exe twice, so set-version.ps1 rewrote a docs file on every release. It now globs winmedic-v*.exe out of the download directory — which is what the reader has in front of them anyway:

$exe      = Get-Item .\winmedic-v*.exe | Select-Object -First 1
$expected = (Get-Content "$($exe.FullName).sha256").Split(' ')[0]
$actual   = (Get-FileHash $exe.FullName -Algorithm SHA256).Hash.ToLower()
if ($expected -eq $actual) { "OK - checksum matches" } else { "MISMATCH - do not run this file" }

Verified against a matching and a tampered file. README.md is therefore out of set-version.ps1's target list, with a note saying why it must not be added back: a target whose pattern never matches makes the script throw.

scripts/prepare-release.ps1 opens the pull request this one is. The release workflow cannot land its own bump on main — the branch is protected, GITHUB_TOKEN is not allowed through, and the pull-request fallback needs a setting that is off. That is why run #7 went red while v0.4.0 itself shipped perfectly.

Both documented fixes hand CI a way past branch protection. This takes the other road — the bump goes down the same reviewed, CI-gated path as every other change:

./scripts/prepare-release.ps1 0.4.2   # branch, set-version, commit, PR
# merge it, then:
gh workflow run release.yml --ref main -f version=0.4.2

Releasing from a main that already states the version makes the workflow's own bump step a no-op — it finds every site correct, tags HEAD unchanged, and the check it failed on passes.

The script refuses a version that has already shipped, a dirty tree and an existing branch, and warns when docs/release-notes/<tag>.md is missing while writing one is still cheap. -NoPush prepares the commit locally without pushing or opening anything. All four paths were exercised locally.

CONTRIBUTING.md and the workflow's own guidance now describe that path first. CONTRIBUTING also claimed the workflow "brings main up to date", which is the one thing it cannot do.

Does it change what WinMedic does to a system?

• No — version strings, release tooling and documentation only.

Checks

• set-version.ps1 0.4.1 -Check passes with README removed from its targets
• prepare-release.ps1 end-to-end with -NoPush, plus its invalid-version, already-shipped-tag and dirty-tree guards
• release.yml still parses; both jobs intact

🤖 Generated with Claude Code