fix: rebuild v1.1.1 from patched runtime

[bradtaylorsf]

Closes #89

What changed

• bump active release/install/runtime identities to immutable v1.1.1
• require and bootstrap official Node.js 22.23.2 with pinned official checksums
• pin both Docker stages to the current multi-platform bookworm-slim digest
• refresh Debian packages and remove npm/Corepack/pnpm from the final runtime
• add a pre-publication Trivy gate for linux/amd64 and linux/arm64 with JSON evidence
• keep v1.1.0 and its published digest unchanged

Verification

• pnpm install --frozen-lockfile
• pnpm verify: 581 passed, 1 intentionally skipped
• pnpm audit --audit-level high: no known vulnerabilities
• pnpm audit --prod --audit-level high: no known vulnerabilities
• local linux/arm64 candidate: 0 fixable critical/high findings (Trivy 0.74.0)
• local linux/amd64 candidate: 0 fixable critical/high findings (Trivy 0.74.0)
• deterministic v1.1.1 candidate assembled from commit e44aa6b; all SHA256SUMS verified
• server, CLI, MCP, and installer package dry runs passed

Temporary candidate/scanner images, scanner cache, and generated installer candidate were removed after verification. No npm package was published.