Tether 1.1

Security hardening patch over 1.0. Further hardening continues on the 1.x line (1.2, …).

Fixes

• Phone terminal is virtual-only (no Mac zsh fall-through)
• Cap + timeout unauthenticated inbound handshakes; global handshake lockout
• Device keys Keychain-only; legacy on-disk mirrors cleared
• Upload abort on disconnect, chunk bounds, symlink write rejection
• Paginated listings under frame limit; relay prelude timeouts
• Narrower host sandbox (removed whole-home temporary exception)

Verify

• 25/25 swift test
• TetherHost (macOS) and TetherClient (iOS Simulator) builds succeeded

Tag: v1.1 (138c0d3) on branch release/1.1.