Release v1.1.6

fix: refresh pnpm lockfile to v9.0 and modernize toolchain

The Obsidian community plugin scan flagged the pnpm lockfile as out of
date. The committed lockfile was lockfileVersion 6.1 (pnpm 8), which a
modern pnpm rejects (ERR_PNPM_LOCKFILE_BREAKING_CHANGE) - the plugin was
removed from the community list on 2026-05-12.

Regenerate the lockfile to 9.0 and modernize the toolchain so it stays
valid:

- pnpm 11 (packageManager) + lockfile regenerated to 9.0
- update all dependencies to latest (esbuild 0.28, typescript 6,
  husky 9, semantic-release 25, commitlint 21, @types/node 22)
- pin obsidian (^1.13.0) instead of floating "latest"
- tsconfig: bundler resolution + src/* paths (replaces deprecated
  baseUrl), explicit types: [node]
- pnpm-workspace.yaml allowBuilds for esbuild (pnpm 11 build-script gate)
- husky 9 hook format
- CI: Node 22, pnpm 11, all actions pinned by commit SHA, Trivy
  supply-chain gate (fails on HIGH/CRITICAL vulns or leaked secrets),
  frozen-lockfile install, least-privilege permissions
- remove dead eslint config

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>