Fix managed Bitwarden session status

[turinglabsorg]

Summary

• Make hush doctor validate the encrypted BITWARDEN_SESSION automatically.
• Make hush bitwarden status report whether the validated session came from encrypted storage.
• Keep session injection scoped to the bw status subprocess.
• Bump the release version to 0.4.1.

Verification

• cargo test --locked
• cargo clippy --locked -- -D warnings
• cargo fmt --check
• Skill validation
• Live doctor and bitwarden status against the encrypted agent session