chore: prepare v2.1.1 release corrections

[ZihangDong]

Summary

• prepare immutable patch release 2.1.1 without moving the existing v2.1.0 tag or npm version
• synchronize Desktop, Tauri, Rust, CLI/MCP, UI, legal and documentation version surfaces
• add a release-version contract test and run it first in the complete release suite
• update GitHub Actions v5 references and protect local npm/environment configuration from accidental commits

Validation

• npm ci
• npm run test:release-version
• npm run test:release (52 scripts)
• npm audit --audit-level=high
• npm audit signatures
• cargo audit --target-os windows --target-arch x86_64 -D unsound -D yanked --ignore RUSTSEC-2024-0429
• cargo test --locked (71 tests)
• npm run tauri build
• npm pack / publish dry-run plus clean CLI install, --version and doctor
• git diff --check and tracked-file/secret/path audits

Audited local artifacts

• NSIS: toolknit-desktop_2.1.1_x64-setup.exe
• NSIS SHA-256: 71ce8a584af63bf1b4f47540689741db3d0a206e0b65cdf694091f617fd607ee
• CLI: @toolknit/cli@2.1.1, 106 files, clean install verified

No v2.1.1 tag, GitHub Release or npm package is created by this PR. The existing v2.1.0 tag/package and historical contribution records remain unchanged.