chore(release): bump version to 0.4.1

[d-v-b]

🤖 AI text below 🤖

The v0.4.1 tag was cut without bumping the package version, so the CD run built every artifact as 0.4.0. Both registries already hold 0.4.0, and both publish steps failed on the duplicate:

• PyPI — ERROR HTTPError: 400 Bad Request from https://upload.pypi.org/legacy/, on the first file (cast_value_rs-0.4.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl). The 120 files for 0.4.0 were uploaded on 2026-04-01.
• crates.io — error: crate zarr-cast-value@0.4.0 already exists on crates.io index, exit 101. The job still reported green because the step carries continue-on-error: true; that is fixed separately.

Nothing was wrong with the builds, trusted publishing, or the Sigstore attestations.

Two files need the bump because the two registries read the version from different places:

• core/Cargo.toml — what cargo publish -p zarr-cast-value releases.
• python/Cargo.toml — python/pyproject.toml declares dynamic = ["version"], so maturin stamps the wheel version from here.

Cargo.lock is regenerated to match.

After merging

The existing v0.4.1 tag points at a2f3ba4, which does not contain this bump, so re-running CD on it would fail identically. The tag needs to be moved to the merge commit (or a fresh v0.4.2 cut) for the release to go through.

Testing

cargo test --workspace passes (50 tests).

[codspeed-hq]

Merging this PR will not alter performance

✅ 51 untouched benchmarks
⏩ 21 skipped benchmarks¹

---

_{Comparing fix/bump-version-0.4.1 (1d8e524) with main (a2f3ba4)}

Footnotes

1. 21 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[d-v-b]

🤖 AI text below 🤖

Superseded by #33. v0.4.1 is being left alone as a release that did not publish, rather than having its tag moved, so the bump targets 0.4.2 instead.