Prepare the 0.11.0 release

[GaryJones]

Summary

This prepares the 0.11.0 release across the usual release surfaces: the CHANGELOG.md entry; the version bump (plugin header, EDIT_FLOW_VERSION, README Stable tag, the AGENTS.md version row, and the npm manifests) from 0.10.4 to 0.11.0; and a regenerated languages/edit-flow.pot, which now includes the new strings from the security work (e.g. the reply-parent and migration-target validation messages, and the de-entitied Cheatin’ uh?).

0.11.0 completes the security-review remediation that 0.10.4 began. It resolves the remaining findings from a full audit of the plugin's authenticated code paths — the headline stored XSS in the editorial-metadata location field, two information-disclosure issues (the iCal feed and the Story Budget), and the full defence-in-depth sweep across access control, input handling, deserialisation, output escaping, code quality and client-side JS — along with the non-security fixes, documentation and maintenance merged since. See the CHANGELOG for the full, attributed list.

This is a minor rather than a patch bump because of one breaking change: the iCal subscription feed now uses a per-user, revocable secret instead of a single site-wide key. Existing calendar-subscription URLs will stop working, and each user must copy their new feed URL from the calendar's Screen Options. Whoever cuts the release should call this out in the release notes.

While regenerating the POT it became clear make-pot derives the text domain and bug-report URL from the checkout directory name, which is wrong in worktree-based setups, so the i18n composer script now pins --slug=edit-flow.

Test plan

• php -l passes, composer.json/package.json are valid JSON; no stray 0.10.4 version strings remain.
• CHANGELOG entry follows the existing Keep a Changelog format with a [0.11.0] compare link.
• POT regenerated via composer i18n; header diff is limited to the version and creation date.