Release Neuroglancer plugin v1.1.1

[den-sq]

Summary

Prepare the Neuroglancer plugin v1.1.1 release.

• bump the packaged plugin and lockfile version to 1.1.1
• update the documented production tag and artifact name
• update CI release fixtures to v1.1.1
• release the reproducible-build and directory-request regression hardening merged in Harden reproducible builds and directory regression coverage #13

Verification

• locked install with Node 24 and npm 11.19.0
• npm test (8 tests)
• npm run smoke:dev
• npm audit --audit-level=moderate (0 vulnerabilities)
• npm run build:release
• npm run validate:release
• npm run validate:archive -- dist/neuroglancer-plugin-v1.1.1.zip

The generated archive manifest reports release tag v1.1.1, package version
1.1.1, and artifact name neuroglancer-plugin-v1.1.1.zip.

Post-merge

Tag the merged commit as v1.1.1 to trigger the release workflow and publish
neuroglancer-plugin-v1.1.1.zip.

[tavateva]

APPROVE — clean, complete, correctly-scoped version bump.

Verified completeness (the only thing that matters for a release bump): every plugin version reference moves v1.1.0 → v1.1.1 together —

• package.json version,
• package-lock.json both the top-level version and packages[""].version (the field pair that's easy to half-update),
• README.md production tag + release asset,
• CI OUROBOROS_PLUGIN_RELEASE_TAG / OUROBOROS_PLUGIN_ARTIFACT fixtures (the -ci variant).

I grepped the whole tree: the only surviving "version": "1.1.0" is node_modules/reusify — an unrelated transitive dep, correctly left alone. No stale plugin self-reference anywhere. CI is green on ubuntu/windows/artifact (so npm ci confirms lockfile↔package.json consistency and validate:release/validate:archive pass against the v1.1.1 fixtures), and the diff is nothing but the bump — no scope creep.

One release-readiness reminder, not a change request: this PR's post-merge step is the v1.1.1 tag that actually ships #13's hardening, and the one outstanding acceptance item from #12/#13 is the interactive Ouroboros directory-selection smoke against current Ouroboros main (AC8 — it wasn't in #13's verification and isn't in this body). If it hasn't been run since #13 merged, run and record it before tagging v1.1.1; the automated coverage (the 8 protocol tests) exercises the same correlation/stale/rapid-switch logic, but that interactive smoke is the release-qualification gate we flagged. If it's already been done, disregard.