[iLevyTate]

Summary

• Version 5.1.1: package.json and package-lock.json.
• CHANGELOG: the Unreleased packaging fix from Keep the project folder out of app.asar and correct the 5.1.0 notes #58 becomes [5.1.1] - 2026-11-01. The 5.1.0 known issue now says it is fixed in 5.1.1, and the compare links are updated.
• SECURITY.md now says it applies to 5.1.1, and the example patch versions move up. The beta tester and install guides name the 5.1.1 downloads.
• After merge: create the v5.1.1 tag with create-release-tag.yml, then run release.yml and mac-release.yml on it. verify-packaged-artifacts.js now fails any build whose app.asar still holds the project folder.

Scope

• Area(s): release metadata and docs
• Risk Level: low. Version and docs only; the code change shipped in Keep the project folder out of app.asar and correct the 5.1.0 notes #58.
• Breaking Changes: none

Type of Change

• Bug fix
• Enhancement
• New feature
• Refactor
• Documentation update
• Breaking change

Test Plan

Automated

• npm run format:check (Prettier on the changed docs)
• npm run lint
• npm test
• Additional tests added/updated when behavior changed

npm run ci is running locally on this commit; I'll report the result here before merging.

Manual QA

• Manual checklist completed (see docs/TESTING.md)
• Not applicable (explain below)

Manual QA notes:

• The packaged builds in the release workflows check app.asar. I'll compare the 5.1.1 download sizes with 5.0.0 and 5.1.0 after publishing.

Checklist

• I scoped this PR to one logical change
• I self-reviewed code and naming for clarity
• I updated docs/config references where needed
• I called out follow-up work or known limitations

---

Generated by Claude Code