Release Berthly 1.4.1: adopt container 1.4.1, call out GHSA-4587-w9mm-xxvh

[henrywang]

Cut Berthly 1.4.1 once the milestone's other issues land.

Release notes must state

• Berthly now builds against apple/container 1.4.1 / containerization 0.45.0.
• containerization 0.45.0 fixes GHSA-4587-w9mm-xxvh (OCI image load follows oci-layout/index.json symlinks outside the extraction dir). Berthly's Load OCI tar sheet exercises this path, but extraction runs in container-apiserver - users must install container 1.4.1 to actually get the fix; updating Berthly alone is not enough. Point users at the in-app updater / container system update.
• Whatever version-gate behavior ships (hard gate vs. recommended tier) - tell users on older daemons what they'll see.

Tasks

• All other v1.4.1 issues merged
• Version bump (follow release-berthly skill / RELEASING.md)
• "What's Changed" written from the actual diff
• Update the download badge/link in README.md (currently pinned to 1.3.1)
• Verify the published DMG

[henrywang]

Released as v1.4.1: https://github.com/henrywang/Berthly/releases/tag/v1.4.1

• All prerequisite issues (chore(deps): bump apple/container to 1.4.1 / containerization to 0.45.0 #147-docs: re-audit PARITY.md against container 1.4.1 (incl. container clean) #150) merged into main first.
• Version bumped 1.3.1 -> 1.4.1 (build 7 -> 8), README download badge updated.
• Pre-release checks: swiftlint --strict clean, BerthlyTests + BerthlyUITests (mock) passed on the merged main tip before publishing.
• scripts/release.sh needed 3 attempts locally — the first two hit a transient Finder AppleEvent timeout (-1712) during the DMG window-styling step, no DMG/notarization/release was produced by either failed attempt (confirmed clean before each retry). Third attempt completed cleanly: notarization Accepted, stapled, appcast updated, GitHub release published.
• Release notes rewritten with the real What's Changed (container 1.4.1 adoption, the GHSA-4587-w9mm-xxvh fix and why users must also upgrade the container daemon itself to actually get it, the hard version-gate rationale, and the container clean/PARITY.md doc update), keeping the auto-generated Testing section.
• Verified: both Berthly-1.4.1.dmg (28,646,286 bytes) and appcast.xml (856 bytes) attached; README's download badge resolves 200.

Closing as resolved.