release: bump 0.1.0 -> 0.1.1

[kingchenc]

Version-strings only, which is the point: a bump that carries nothing else has
a CI run that is unambiguous, and a failure in it can only come from the bump.

Do not merge this yet — merging it is the last reversible step. The tag that
follows publishes to six registries and cannot be taken back.

What moved

Produced by bump_version.py, not by hand — 20 touchpoints across eight
languages, each with an expected hit count, so a manifest that quietly stops
matching is a failure rather than a silent skip:

Cargo.toml	3
bindings/node/package.json	7 (version + six optionalDependencies)
bindings/node/npm/<rid>/package.json	6 × 1
bindings/node/index.js	52 (the napi loader's version literal)
bindings/node/package-lock.json	19, one third-party entry left alone
bindings/python/pyproject.toml, bindings/java/pom.xml, Wickra.Backtest.csproj, bindings/r/DESCRIPTION	1 each
examples/java/pom.xml	2 (its own version and the dependency)
SECURITY.md	3
CITATION.cff	version and date-released
Cargo.lock	refreshed by cargo build, never edited

CITATION.cff is new to that list. It became a version touchpoint in #115 when
it grew version: and date-released:, and the bump tool had not followed — so
this bump would have left the citation naming 0.1.0 while every manifest said
0.1.1, with nothing downstream to catch it, since GitHub's citation box and
Zenodo read that file and no build does. Fixed in the tooling repo, along with
date-released, which no replacement finds because it is not a version: left
alone it names the day of the previous release beside the new version, and a
reader cannot tell which of the two is stale.

Changelog

[0.1.1] collects what #115 landed — the publish gate, the ref guard, the split
wasm-build, CodeQL over the four compiled bindings, actionlint, CodSpeed,
semver, the container smoke job, the C golden test, the schema check — and two
entries that #116 should have written and did not:

• the docs/ signpost under Added
• the cross-library benchmark under a new Fixed section, which had been red
  for three consecutive nights without anyone noticing

Verification

cargo fmt, cargo test --workspace --all-features (21 suites), cargo clippy -D warnings, cargo deny, actionlint with shellcheck, and all six check
scripts: green. check_version_sync.py agrees across 18 declarations at 0.1.1.

The diff outside CHANGELOG.md and the two lockfiles contains no line that is
not a version string — checked, not assumed.

Line endings are unchanged: git ls-files --eol reports 285 index entries as
i/lf and none as CRLF.

What is still unproven, and will be until the tag

release.yml runs on push: tags: ["v*"] and nothing else, so five things
land in it for the first time on this release: the gate job, its ref guard,
the split wasm-build, the go build/go test inside go-mirror, and
provenance extended to the nupkg, the jar and the C ABI archives.

Each is built so that failing blocks rather than half-publishes — the gate
sits before the first irreversible step rather than after it, and refuses to
open unless this exact commit has a green ci.yml and nothing red. That is the
argument for merging it, not against; but it is worth naming before the tag
rather than after.

After merge

Note the merge SHA. The tag is set on that SHA explicitly —
git tag -s v0.1.1 <merge-sha> — because git tag without a ref captures the
local HEAD, which is not necessarily the merge commit. Only after explicit
go-ahead.

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing release/0.1.1 (62706f6) with main (e196cbc)¹}

Footnotes

1. No successful run was found on main (426cdd0) during the generation of this report, so e196cbc was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!