chore(main): release 4.1.0 - #592

## Summary
Fix missing required checks on merge-queue commits:
- Add merge_group triggers to PR lint, pre-commit, and Bash 3.2
compatibility workflows.
- Run the PR title validator only on PR events; acknowledge previously
validated titles on merge groups.
- Use the merge-group base SHA for Bash relevance detection, validate
the SHA, and preserve fail-closed behavior.

Refs: #607
Unblocks: #592
Related fix: GSA-TTS/agentic-coding-patterns#524

## Verification
- PASS: YAML, whitespace, EOF, merge-conflict checks, and git diff
--check.
- PASS: shell syntax and focused relevance tests covering
malformed/missing SHAs, relevant/irrelevant paths, and fetch/diff
failures.
- PASS: all 16 upstream-result gate combinations.
- PASS: adversarial AI subagent review found no blockers.
- BLOCKED locally: full pre-commit exhausted disk space while building
pinned gitleaks; actionlint unavailable.
- Pending: PR CI and all three required contexts reporting on a real
merge-group SHA with successful queue progression.

## Security impact
Preserves required check names, read-only permissions, pinned actions,
and queue-ref concurrency isolation.

## Rollback
Revert this commit; doing so restores the missing merge-group checks.

## AI assistance
Implemented and reviewed with OpenCode AI agents under the approved
three-workflow plan. Human review remains pending.