chore(v0.4.1): open branch — disable auto-improve self-patcher by default

Carry the uncommitted off-switch into v0.4.1 and bump version to 0.4.1.

- runtime/auto-improve.js: PEPA_AUTO_IMPROVE=off skips the self-patcher,
  which committed LLM diffs and checked out branches (observed 2026-05-28
  checking out a stale local `main`). Direction is operator-drained
  improvement_requests, not auto-apply — proposals still written to disk.
- package.json: 0.4.0 -> 0.4.1

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pepa-pi-bot",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "private": true,
   "description": "An autonomous, self-extending Minecraft player powered by Pi and Mineflayer.",
   "license": "MIT",

runtime/auto-improve.js

@@ -113,6 +113,15 @@ let pollTimer = null;
 
 export function startAutoImprover() {
 	if (pollTimer) return;
+	// Off-switch: the self-patcher commits LLM-generated diffs and checks out
+	// branches, which can leave the working tree on the wrong branch mid-run
+	// (observed 2026-05-28: it checked out a stale local `main`). The research
+	// direction is operator-drained improvement_requests, not auto-apply — so
+	// set PEPA_AUTO_IMPROVE=off to keep proposals on disk without patching.
+	if (String(process.env.PEPA_AUTO_IMPROVE ?? "").toLowerCase() === "off") {
+		info("auto-improve", "disabled via PEPA_AUTO_IMPROVE=off — proposals written but not auto-applied");
+		return;
+	}
 	info("auto-improve", `watching ${PROPOSALS_DIR} (cooldown=${COOLDOWN_MS / 1000}s, max ${MAX_TOTAL_PER_HOUR}/hr)`);
 	pollTimer = setInterval(tick, 2000);
 }