Fix release regressions and prepare 1.1.1

[rebel0789]

What changed

• Fix the P2 review finding from prepare npm 1.1.0 package contract #22 so default installed benchmarks always use the package fixture; only an explicit --dataset may resolve from the workspace.
• Forward SIGINT and SIGTERM from recall serve to the Control API child so consumer processes shut down cleanly.
• Reuse the already-built context pack for MCP readback in Token Saver and handoff measurement, removing the duplicate repository scan while preserving schema and fingerprint verification.
• Align the Rust MCP server-info version with the 1.1.1 Node package so cross-runtime conformance remains byte-identical.
• Prepare honest 1.1.1 patch metadata and generated release evidence without claiming that npm has already been published.

Root cause and impact

The default benchmark resolver treated the bundled fixture name like an implicit workspace path, so a same-named repository file could shadow package data. The serve wrapper also did not relay termination signals. Token Saver rebuilt the same context pack in a child process solely to prove MCP readback, doubling the repository scan. The patch version bump initially left Rust server metadata at 1.1.0; GitHub CI exposed that parity drift and the branch now fixes it.

This patch makes installed behavior deterministic, makes the local server lifecycle reliable, and reduces Token Saver work without changing its read-only, local-only, zero-model-call contract.

Validation

• npm run verify:handoff: 664/664 Node tests, 182/182 protocol fixtures, evaluation suite, demo, and native provider smoke passed.
• node scripts/rust-recall-conformance.mjs: Node/Rust MCP byte parity passed.
• GitHub Actions: CI, CodeQL, and the full Rust workflow passed on ffde3a6.
• npm run consumer:smoke passed against an isolated packed install.
• npm run consumer:browser-smoke passed for Overview, Recall Map, handoff, Token Saver, memory, graph, and mobile shell.
• npm run release:readiness:check passed with no artifact drift.
• npm audit --omit=dev: 0 vulnerabilities.
• npm publish --dry-run --access public --tag latest --json: memory-recall@1.1.1, 1,210,678-byte tarball, passed.

No npm publish, tag, release, or production deployment is performed by this PR.