chore(release): v1.1.0 with a validated single-source release version

[TheStreamCode]

Summary

• Prepare the public Agent Skill for v1.1.0 and keep package.json, SKILL.md metadata, CITATION.cff, the README badge, the dated changelog, and issue metadata synchronized.
• Make package.json the validated release-version source of truth and remove the hardcoded activation version from the host-smoke runner.
• Preflight every managed init destination before the first write, preventing late path conflicts from leaving partial scaffolding.
• Reject contradictory currentPhase and stage-gate decision metadata before state-changing commands can persist an invalid workflow.
• Stop repository Markdown validation from following symlinked directories; required files must be regular files.
• Restrict disposable repository test copies to project-owned roots and report malformed package.json content as a validation finding instead of crashing.
• Add a dated v1.1.0 security review and synchronize README, SECURITY.md, CHANGELOG.md, AGENTS.md, and release guidance.

Versioning: minor bump under SemVer for the additive workflow 1.1 contract. Existing workflow 1.0 state remains readable, the v1 artifact layout is unchanged, and v0.3 workspaces remain preserved and rejected rather than migrated.

Validation

Local environment: Windows 11, Node.js 24.18.0, npm 11.16.0, Python 3.12.10, GitHub CLI 2.96.0.

• npm run check: repository validation passed; 33 tests, 30 passed, 0 failed, 3 skipped because Windows symlink creation returned EPERM; benchmark passed.
• Benchmark package: 18 files, 86,693 bytes; p95 init 60.27 ms, status 60.24 ms, validate 58.99 ms, all within guardrails.
• Hash-pinned official Agent Skills validator: valid skill, exit 0.
• gh skill publish --dry-run: passed, exit 0.
• Local gh skill install smoke: 18 files installed into a disposable custom directory; installed CLI help and official validation passed; no artifact secret pattern found; temporary copy removed.
• Syntax, diff, Git integrity, tracked-secret pattern, and dependency inventory checks completed; the runtime dependency tree is empty.
• Host discovery smoke executed but was inconclusive: GitHub Copilot CLI and OpenCode were not installed, so zero eligible checks ran and exit 3 was preserved. No model-backed smoke was run.
• Remote CI and CodeQL on eaa0e0f: 12/12 checks passed across Node.js 20/22/24, Linux, Windows, macOS, specification/discovery, performance, Actions analysis, JavaScript analysis, and aggregate quality.

Compatibility And Safety Notes

• Breaking workflow or state change: none.
• Workflow versions read/written: new runs write 1.1; existing 1.0 state remains readable.
• Host compatibility impact: none beyond metadata version alignment; no host-specific allowed-tools were introduced.
• Authorization or safety impact: stronger local path/state validation only; no new network, credential, deployment, or external-mutation capability.
• Security evidence: evals/security-review-v1.1.0.md records fixed findings and residual limits.
• GitHub release immutability is now enabled at repository level and verified through the official API. Existing v1.0.0 remains mutable; v1.1.0 must be checked after publication.

Release State And Remaining Gate

• Head commit: eaa0e0f.
• The branch and PR are pushed and all required automated checks are green.
• Main requires one approving review and resolved conversations. This PR remains blocked only by review; no protection bypass or direct main push was used.
• Tag v1.1.0, GitHub Release, and public gh skill publication have not been created. They must be produced from the reviewed merge commit and verified immutable.

Existing Commit Metadata

The first two pre-existing commits on this branch contain AI co-author trailers that conflict with the current AGENTS.md convention. Their history was not rewritten. Prefer squash merge with a clean maintainer-authored message so the main-branch commit follows repository policy.