v0.41.1

### Fixed

- **Locally terminated *outbound* calls now BYE the carrier; hold works on outbound legs** (completes issue #342 — the outbound half; fixed upstream by [siphon-rs#70](https://github.com/thevoiceguy/siphon-rs/pull/70), pin bumped `fbdf132a11d6` → `5c7cf20beb50`). #342/0.41.0 fixed the *inbound* teardown BYE (route set), but the same stranding persisted on **outbound** calls: hanging one up locally (admin hangup, WS `server_hangup`, drain, controller exit) sent **no BYE**, leaving the callee in dead air until the carrier's ~60 s session timer, and a bot-initiated `hold`/transfer re-INVITE silently failed. Found black-box testing 0.41.0 on the live Twilio trunk. Root cause was in siphon-rs: `TlsPool::send_tls` keyed connection reuse by `(peer_addr, SNI)`. An outbound call's INVITE opens its connection with the request-URI **hostname** SNI, but an in-dialog request (BYE / re-INVITE / REFER) derives its SNI from the peer's `Record-Route` — an **IP literal** for a carrier edge — so it missed the hostname-keyed connection and dialed a **fresh** connect, which the edge refuses and whose IP-SNI handshake fails the edge's hostname cert (`outbound TLS connect … transport error`); the request never reached the wire. Inbound legs were unaffected because they reuse their inbound connection explicitly via a `flow`. The fix makes `send_tls` fall back to reusing any live connection to the same peer `addr` on an exact-key miss (RFC 5923 connection reuse); the TCP pool already keyed by `addr` alone. No siphon-ai code change. Load-bearing regression test upstream (`send_tls_reuses_connection_to_same_addr_across_sni`), CI-proven red without the fix.

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.41.1` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```