Bump version to 1.0.1 - #397

## Why

`v1.0.1` shipped on 21 August. Trunk carries 45 commits since, and this
is the **beta for 1.1.0**, published so contributors can test it before
the stable tag. The headline is the bundled Git: the app ships its own
Git binary and every checkout operation runs on it, so a contributor no
longer needs Git installed (#401 to #411, #418, #420). It also ships the
packaging allow-list (#450) and the fixes closed under the v1.1.0
milestone.

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-beta.1-*`), and `src/logging.js`
writes `app <version>` as the log's first line, so a problem report
names the build it came from. That is why the bump merges before the
tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.0.1` to `1.1.0-beta.1`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0-beta.1`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0-beta.1 1.1.0-beta.1`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-beta.1-*`, and the first line of a
fresh app log must read `app 1.1.0-beta.1`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry `1.0.1`; the replacement was confined to
the first 2000 bytes of the file, which holds the two root entries, and
both files were re-parsed as JSON afterwards.

## Related

Same shape as #244 (v1.0.0-beta.1) and #397 (v1.0.1).

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1316 pass, 0 fail; `git diff --stat` shows
two files, three insertions, three deletions; both JSON files parse.
Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0123opUnXoxs1CAN7YQ7q8KU

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

## Why

`v1.1.0-beta.1` shipped on 12 September. Trunk carries five commits
since, and this is the **second beta for 1.1.0**, published so
contributors can keep testing before the stable tag. The headline is
checking out a pull request as a real branch, with the author's commits
intact, in place of the unattributed diff the Apply panel produced
(#459, #460, #461, #463, closing #290 and #458); it also gives the app
an address a browser can hand a ticket to, `wpct://ticket/<id>` (#465,
closing #464).

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-beta.2-*`), and `src/logging.js`
writes `app <version>` as the log's first line, so a problem report
names the build it came from. That is why the bump merges before the
tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.1.0-beta.1` to `1.1.0-beta.2`.
No dependency versions change, and there is no application behaviour
change in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0-beta.2`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0-beta.2 1.1.0-beta.2`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-beta.2-*`, and the first line of a
fresh app log must read `app 1.1.0-beta.2`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry `1.1.0-beta.1`; the replacement was
confined to the first 2000 bytes of the file, which holds the two root
entries, and both files were re-parsed as JSON afterwards.

## Related

Same shape as #397 (v1.0.1) and #457 (v1.1.0-beta.1).

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1451 pass, 0 fail, 2 expected skips; `git
diff --stat` shows two files, three insertions, three deletions; both
JSON files parse. Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0121dia1RzfskutrzA8iSK1K

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

## Why

This is the **stable 1.1.0**. `v1.1.0-beta.1` shipped on 12 September
and `v1.1.0-beta.2` on 14 September; between them they were downloaded
33 times across macOS, Windows and Linux, and no issue was filed against
either. The v1.1.0 milestone is closed, 21 of 21.

Shipping sooner rather than later is itself part of the reasoning: a
site created by 1.0 cannot be written to by 1.1, so every day 1.0.1
remains the stable release is another day of sites being created that
the next version can only read.

Four commits reach this tag that no beta carried: the Linux target list
narrowed to the one artifact that is actually published and probed
(#467), the apply panel moved above the site's other tickets (#472), the
applied-patch record now travelling with carried work (#473), and the
sidebar heading renamed (#482). Three of the four are visible on screen,
so the artifact gets a manual pass before the release is published
rather than the packaging check alone.

The version reaches two places a contributor sees, and both must carry
the real build: electron-builder embeds it in the artifact names
(`wordpress-contributor-toolkit-1.1.0-*`), and `src/logging.js` writes
`app <version>` as the log's first line, so a problem report names the
build it came from. That is why the bump merges before the tag.

## What changes

Only the version. All three package-version fields in `package.json` and
`package-lock.json` move together from `1.1.0-beta.2` to `1.1.0`. No
dependency versions change, and there is no application behaviour change
in this PR.

## How to test this

Platforms: any for the suite; macOS or Windows for the artifact check
that follows the merge.

In the repository root:

1. `npm run lint` is clean and `npm test` passes.
2. `node -e "console.log(require('./package.json').version)"` prints
`1.1.0`.
3. `python3 -c "import
json;d=json.load(open('package-lock.json'));print(d['version'],
d['packages']['']['version'])"` prints `1.1.0 1.1.0`.

**What must not have happened:** no dependency version may change. `git
diff trunk` shows exactly three changed lines, all of them the root
package version.

After merge, the release build must produce artifacts named
`wordpress-contributor-toolkit-1.1.0-*`, and the first line of a fresh
app log must read `app 1.1.0`.

## Risks and limitations

No UI change. The risk is a mis-scoped edit in `package-lock.json`,
where dependencies also carry version strings; the replacement was
confined to the first 2000 bytes of the file, which holds the two root
entries, and both files were re-parsed as JSON afterwards.

Unlike the betas, this tag becomes `releases/latest`, so it is what the
README badge and every "download the toolkit" link resolve to.

## Related

Same shape as #397 (v1.0.1), #457 (v1.1.0-beta.1) and #466
(v1.1.0-beta.2). The Gutenberg stack for v1.2.0 is held as a draft at
#468 until this tag is pushed, so it cannot reach trunk and ship inside
a release it has never been tested in; #479 waits for the same reason.

---

<details>
<summary>Review outcome (required — see AGENTS.md)</summary>

Version-only change, three lines. Verified locally on this branch: `npm
run lint` clean, `npm test` 1454 pass, 0 fail, 2 expected skips; `git
diff --stat` shows two files, three insertions, three deletions; both
JSON files parse. Nothing to fix, nothing deferred.

</details>

<details>
<summary>Screenshots or recording</summary>

Nothing on screen changes.

</details>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0121dia1RzfskutrzA8iSK1K

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>