[chaliy]

What changed

Prepare Markkit 0.1.1 from the reviewed security main1405ff748f15ebb2c602e35591f7ed4cc85ec125. Public Rust and binding APIs are unchanged; HTTP/ZIP/spreadsheet dependency upgrades stay internal, so this is a patch release. The CLI now requires markkit>=0.1.1.

Fix native packaging before tagging: generate the npm JS loader with --platform, include the native binary, and verify installed tarball loading/extraction. The first npm artifact is explicitly Linux x64/glibc only (README and os/cpu/libc metadata). The Python publisher remains Linux x64/CPython3.12 and now verifies wheel metadata plus clean native import/extraction. Both publishers verify Cargo.lock stayed unchanged and check existing credential presence without disclosing values.

Release behavior

Merging this release-preparation title triggers the established release workflow: tagv0.1.1, GitHub Release, then crates.io markkit followed by markkit-cli. Python/npm publication remains a separate manual workflow on that verified tag. Their credential availability is not assumed and no credentials, permissions or billing settings are changed.

Validation

• just pre-pr passed: fmt, workspace clippy/tests, cargo-deny advisories/bans/licenses/sources.
• cargo publish -p markkit --dry-run --locked packaged and compiled successfully; no upload.
• Actual NAPI release build and tarball loader/native extraction smoke passed locally on Darwin; that prototype is not a published artifact. Clean Linux tarball installation/load is required by the updated JS CI and publisher.
• actionlint passed for all changed workflows; native build preserved patched Cargo.lock.
• CLI HTML extraction smoke passed.

Library consumers must refresh their own application lockfiles for transitive TLS updates; a dependency library's lockfile is not inherited.