Bump @inplan/cli to 0.1.11.

The release pipeline now bakes the plugin trust-root PUBLIC key into the desktop
build (INPLAN_PLUGIN_PUBLIC_KEY) and sets INPLAN_REQUIRE_PLUGIN_KEY=1 so a build
that forgets it fails loudly rather than silently shipping with no trust root.
With the key baked in, a published build can verify an entitlement lease + the
fetched plugin bundle against it (the cloud signs with the matching private key).