fix: make governance freeze cross-platform

[HERRY423]

Summary

• normalize governed UTF-8 text to LF before hashing and publish governance-freeze schema v2
• add a CRLF/LF cross-platform regression test
• harden release smoke tests so imports must resolve inside the fresh venv and CLI checks run outside the checkout
• bump the patch release to 0.4.1 without changing decision, Atlas, calibration, benchmark, or biological claim semantics

Root cause

The v0.4.0 PyPI wheel was valid and importable, but five governed text files were LF-normalized by the Linux packaging path while the freeze was created from a Windows CRLF worktree. Raw-byte hashes therefore produced a false integrity failure. The old release smoke could be shadowed by the editable source environment.

Verification

• Ruff lint and format checks pass
• tests/test_domain_depth_release.py: 5 passed
• tests/test_release_packaging.py: 6 passed
• wheel/sdist build and twine check pass
• fresh venv outside the repository verifies schema v2 over 26 governed files

Scientific boundary

This patch repairs cross-platform software integrity verification only. It adds no biological validation and does not change the retained incomplete five-cohort or domain claim-readiness status.