v0.1.1 - Security hardening

Security release

Version 0.1.1 publishes the post-release availability fixes and tightens the
default operating mode for every installation.

Fixed

• Reject top-level JSON-RPC batches before dispatch so one HTTP request cannot
  fan out into unbounded tool work.
• Bound admission queueing and request-body upload with one absolute deadline.
• Bound post-upload tool execution and keep concurrency admission active until
  a streamed response completes, is cancelled or reaches its deadline.
• Set Cache-Control: no-store and Vary: Authorization on MCP responses.
• Limit the unauthenticated health response to { "status": "ok" }.

The first two issues affect availability in 0.1.0. Version 0.1.1 is the
supported release.

Safer write defaults

• The server now starts read-only. Set LIVESPACE_MCP_ENABLE_WRITES=true to
  expose write tools.
• Write-enabled startup requires both a random MCP_AUTH_TOKEN and an
  independent MCP_REQUEST_STATE_KEY, including on loopback.
• LIVESPACE_MCP_READ_ONLY=true remains an emergency kill switch.
• Clients without form elicitation can preview writes, but confirm: true is
  refused by default. The operator-only
  MCP_ALLOW_UNBOUND_WRITE_CONFIRMATION=true escape hatch restores the older,
  less protected behavior.

See the updated README before enabling writes. Use a dedicated, least-
privilege Livespace API user and test the integration on a separate account.

Release integrity

The release workflow uses GitHub OIDC trusted publishing, npm provenance,
SHA-pinned actions, a protected release environment and immutable v* tags.
The candidate passed 1135 tests, typecheck, dependency audit, secret scan,
package installation, read-only sandbox smoke and the official MCP conformance
baseline.