v0.4.1

You can do a rolling upgrade from v0.4.0.

Highlights:

- **Balance cell ownership across the fleet.** A node that joins takes
  hibernated cells from the nodes that hold the most, so it carries its share
  within minutes instead of waiting for new traffic. The fleet evens out
  again after a node leaves. One node samples the leases for the whole fleet,
  so the cost does not grow with the square of the fleet.
- **Restore a large cell page by page.** The cell reads each page from the
  object store on first use, so it serves requests before the download
  completes. A large cell also hands off through its LTX chain instead of a
  whole-database snapshot.
- **Queue throughput improves by an order of magnitude.** Producer calls
  share transactions and durability rounds, and each message gets a
  time-ordered id. One Queue sustained 7,357 sends per second over a
  300,000-send soak with exact delivery, up from a few hundred.
- **Fewer false durability timeouts under load.** The budget measures a
  stall: a queued write waits while the node keeps landing proofs. A follower
  commits a burst of frames as one fsync chain, and CRC64 verification uses
  SIMD.
- **Alarms scale to the due work.** The waker lists one bucket per armed
  minute and opens only the due ones. Only the elected waker probes the
  fleet, and the activation bound derives from store latency, so alarms of
  evicted cells fire on time under load.
- **Recover from a whole-fleet restart.** A restarting node serves follower
  fragments while it recovers its own predecessor, so nodes that restart
  together recover acknowledged writes. Recovery checkpoints its progress and
  holds a heartbeat, so a retry skips finished work and peers do not repeat
  it.
- **Durable Object facets.** `ctx.facets` provides `get()`, `abort()`, and
  `delete()`. Each facet gets an isolated SQLite database that celld
  replicates with the root object.
- **More Node.js and web platform APIs.** `node:fs`, `node:os`,
  `node:diagnostics_channel`, a read-only `/bundle`, and a per-request
  `/tmp`. `HTMLRewriter`, `EventSource`, `MessageChannel`, the `Cache` API
  surface, outbound TCP through `cloudflare:sockets`, and Web Crypto KDF
  derivation, key wrapping, and RSA signing.
- **A tighter output gate.** An error answer, each chunk of a streaming body,
  a call into a loaded Worker, and the answer of a handler that fails after
  it commits all wait for the proof of the writes they depend on.
  `storage.sync()` returns after the cell's writes are proven durable, and a
  rollback discards writes submitted without `await`.
- **A lease reports why it lost authority.** A self-fence names its cause,
  and a failed renewal retries before the authority expires.
- **Operator commands page.** A cell listing and a KV bulk export no longer
  load a namespace into memory. A lease records store outcomes and owned
  cell count, so `celld diagnose` shows each node's load. `celld dev --clean`
  discards the local state.

Issues fixed:

- #176
- #178
- #179
- #180
- #182
- #183
- #184
- #185
- #186

Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
Co-authored-by: Bert Belder <bertbelder@gmail.com>
Co-authored-by: Daniel Acuna <daniel.acuna@instacart.com>
Co-authored-by: Daniel Levi-Minzi <51272568+dleviminzi@users.noreply.github.com>
Co-authored-by: Josh Collinsworth <josh@deno.com>
Co-authored-by: Nathan Whitaker <17734409+nathanwhit@users.noreply.github.com>
Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev>