We already have: Zope2 2.12.13
but Products.CMFPlone 4.1a1 requires 'Zope2>2.13.0'.
But where did i say i wanted to use Plone 4.1a1? It seems packages which depend on Products.CMFPlone (like plone.app.registry) by default (when running buildout without the -N switch) get the latest version, which is 4.1a1. And this, in turn, tries to pull in the rest of Plone 4.1.
This doesn't happen with Plone 4.0.3, as http://dist.plone.org/release/4.0.3/versions.cfg does the pinning, so upgrading to 4.0.3 is the best option.