rune v0.4.1 CI hardening -- no functional changes from v0.4.0. - deny.toml: cargo-deny license allow-list (MIT, Apache-2.0, BSD, ISC, MPL-2.0) - Pipeline v2.1.0: all images from nomograph container registry, no Docker Hub - Release page includes tag annotation body + mise/manual install instructions - audit_allow_failure: false (deny config makes audit pass cleanly) - Updated yanked fastrand 2.4.0 -> 2.4.1 - Cargo.toml version matches tag (--version reports correctly)