Publish v1.4.1 validation evidence

[hermes-archham]

Summary

Advances the documented validation posture for v1.4.1 after exact-tag/package-artifact validation passed.

Changes:

• sets latest_validated to v1.4.1 in .release-channels.json;
• adds the public-safe v1.4.1 compatibility report for MISP core v2.5.44, modules v3.0.9, guard v1.2;
• updates README, compatibility, validation, readiness, support, security, operator-bundle, and hosted-doc navigation to point at the current validated evidence;
• preserves v1.4.0 and older reports as historical retained evidence.

Validation evidence

Private run 2026-07-31-v1.4.1-exact-tag-artifact-validation passed 11/11 scenarios from the published v1.4.1 operator-bundle artifact:

• 10 baseline lifecycle scenarios;
• release-specific remote reverse-proxy explicit-bind parity gate.

Raw logs and infrastructure identifiers are intentionally omitted from public docs.

Hosted verification

• Repository gates 30649468724 passed
• CodeQL 30649468710 passed
• Operator bundle release assets 30649468777 passed

Independent review pending before readiness.

Local verification

• python3 -m unittest discover -s tests — 177 tests passed, 1 expected skip
• Bash syntax for lifecycle/*.sh and installer/*.sh
• python3 -m py_compile scripts/*.py tests/*.py
• workflow YAML parse
• git diff --check
• hash-enforced docs install
• mkdocs build --strict
• rendered local link crawl, excluding MkDocs-generated 404 root links
• added-line public marker scan

Part of #125.

[hermes-archham]

Hosted verification

Exact head: d7fcf6d80ca3a114fcb189c08e5a2f4003a69eb0

Hosted checks passed:

• Repository gates: 30649468724
• CodeQL: 30649468710
• Operator bundle release assets: 30649468777

Publication behavior remains correct for a pull request: release asset publication is skipped unless the workflow runs for a release event.

[hermes-archham]

Independent review follow-up

Resolved the independent review blocker at docs/contribute-and-maintain.md: the “current validation” link now points to the v1.4.1 compatibility report.

Added a regression assertion so the contributor/maintainer release-evidence path must point at the current v1.4.1 validation report and must not retain the old v1.4.0 link as current validation.

Verification after the fix:

• python3 -m unittest tests.test_static.StaticRepoTests.test_documentation_red_line_entry_points_exist
• python3 -m unittest discover -s tests — 177 tests passed, 1 expected skip
• Bash syntax for lifecycle/*.sh and installer/*.sh
• python3 -m py_compile scripts/*.py tests/*.py
• workflow YAML parse
• git diff --check
• hash-enforced docs install
• mkdocs build --strict
• rendered local link crawl
• added-line public marker scan
• stale current-validation link scan

[hermes-archham]

Follow-up hosted verification

Independent review blocker resolved at follow-up head 43491307279cef0fa236777a6b6fb052cc8176c3.

Hosted checks passed on that exact head:

• Repository gates: 30649980001
• CodeQL: 30649980116
• Operator bundle release assets: 30649980025

PR merge state is clean and the PR remains draft for maintainer approval before readiness.

[archham]

Nice