Rusty 0.1.1

Fixes and hardening after 0.1.0.

• The installer is install.sh at the top of a checkout and of a release; the files it
  installs (the unit, the MCP config, the memory-pressure drop-in) are in service/.
• Search waits at most five seconds for a query's embedding, then answers from the text
  index, so a hung Ollama no longer holds a search for two minutes.
• Two processes indexing one changed file record it once: the check and the write share a
  transaction.
• source_capture, brain_import and brain_rename run off the request's task, so a long
  one no longer holds the server up.
• Bookmarks stay inside the vault, and rusty-cli bookmarks rm removes a folder bookmark
  whose folder was deleted outside Rusty.
• import --replace through a symbolic link replaces the store where it lives, and a
  server still holding a deleted database blocks an import.
• Transcripts without a session id no longer overwrite each other in the archive.
• rusty session status names and resolves the address it probes (RUSTY_MCP_ADDR).
• A client that stops reading no longer holds up change notifications to the others.
• The sweep of outside edits leaves files written in the last three seconds to the process
  that wrote them.
• pdftotext gets thirty seconds and 8 MiB of output, and the PDF's temporary copy is
  private.