Release hygiene: sync CHANGELOG, version surfaces, and post-1.0 docs for 1.1.0

[jose-compu]

Summary

Post-1.0.0 release hygiene: the GitHub release and package versions reached 1.0.0, but several in-repo surfaces still disagree (CHANGELOG still marks 0.9.1–0.12.0 as unreleased, LOGOSDB_VERSION_* stuck at 0.9.0, MCP self-reported version at 0.11.0, SECURITY/README still written for pre-1.0).

Ship as minor 1.1.0.

Scope

• Date CHANGELOG entries for 0.9.1–0.12.0 and add dated 1.0.0 / 1.1.0 sections
• Align version macros and package versions to 1.1.0 (C header, CMake, PyPI, npm workspaces, MCP server version string, dependency ranges, lockfile)
• Update README roadmap for stable post-1.0 semver; correct inaccurate “shipped” items
• Update SECURITY.md, RELEASING.md, and related .md docs for the 1.x support line

Acceptance

• All first-party version strings report 1.1.0
• CHANGELOG no longer lists already-shipped lines as unreleased
• Docs describe post-1.0 patch/minor/major conventions
• Test suite passes

Out of scope

• Windows port (Windows support: abstract POSIX file I/O behind a portable layer #10)
• Remaining Python adapter audit (Security: audit python/logosdb/* integration adapters (passthrough, paths, secrets) #111)
• New runtime features beyond version/docs alignment