chore(release): v0.41.1 — reproducible output no longer path-dependent

[avrabe]

Cut v0.41.1 (0.41.0 → 0.41.1). Scope: #341 — --reproducible output no longer depends on the input file path.

Gate

• rivet release status v0.41.1 → Cuttable (SR-52 verified)
• rivet validate → PASS
• CHANGELOG [0.41.1] with falsification

What ships

Under --reproducible, the caller-supplied component name (CLI passes the input path) no longer leaks into the output — the input identifier is positional component-{index} at all three sites (attestation descriptor, wsc InputArtifact, provenance component_id), content pinned by sha256. Byte-identical inputs at different paths now fuse identically.

Note

#339 (the Finding-A value-pointer gate) was investigated but not shipped — the fix is undecidable without reloc metadata and would over-reject real components + un-do #298. Documented on the issue as a by-design residual (--emit-relocs is the sound path).

Refs #341, #325, SR-52.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}