chore(release): v8.1.1 — own-tree rule narrowed, v8.1.0 follow-ups

Version sync: package.json, .claude-plugin/plugin.json, README (badge +
Recent versions), CLAUDE.md (header + highlights), CHANGELOG [8.1.1]
(incl. Known open from the pre-tag review: a target with no .git of its
own under cwd — node_modules, plugin-cache copy, tarball — still counts
as own; not a regression, the v8.1.0 rule honoured it too).
Remaining `8.1.0` strings are history rows and dated code comments.

Gates on the staged tree: suite 2306 / 2300 pass / 0 fail / 6 skip,
golden 109/7/4 61/61 unchanged, av-surface 6/6, plugin validate pass.
Windows/Defender quarantine: not measured (operator, 22.09).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [8.1.1] - 2026-09-22
+
+Patch that closes the v8.1.0 follow-up list. Detection tables, golden baseline
+and hooks are unchanged. Windows/Defender quarantine is still not measured:
+there is no Windows machine to measure it on, and the release says so rather
+than guessing. 2306 tests, 2300 pass, 6 skipped, 0 fail.
+
 ### Fixed
 
 - **A clone under the working directory is no longer "own working tree".**
@@ -22,7 +29,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   the parent repository no longer applies that checkout's ignore file or
   policy; it now gets the defaults and one stderr line per ignored file.
   Scanning the repository itself or any plain folder inside it is unchanged,
-  and so are hooks, which read the policy from the project root.
+  and so are hooks, which read the policy from the project root. A git
+  worktree of your own repository, checked out inside it, now counts as
+  foreign when scanned from the main checkout; scan it from inside the
+  worktree to apply its configuration.
+
+### Changed
+
+- **The README and `.llm-security-ignore` no longer state the self-scan's
+  suppressed count or its count without the ignore file.** Both changed by
+  one with every commit, because `git-forensics` looks at the last 50 commits
+  — correct behaviour, but it made the figures false one commit after they
+  were written. The verdict, score and finding count with the ignore file,
+  measured on a fresh clone of the release commit, stay.
+
+- **`/security scan` description** names what it accepts: remote git
+  repositories on any host, SSH only for GitHub. It said "GitHub repos".
+
+### Tests
+
+- **`ci.failOn` and `ci.compact` in `policy.json` have a real test.** The old
+  one wrote a policy into a directory it never scanned and passed
+  `--fail-on` on the command line, so it passed without reading the policy.
+
+### Known open
+
+- **A target with no `.git` of its own still counts as the caller's own tree
+  when it sits under the working directory in the same git root (or where
+  neither has one).** That covers what package managers and plugin installs
+  produce: a `node_modules/` package, an installed copy in the Claude Code
+  plugin cache, a tarball or `git archive` export. Such a target's
+  `.llm-security-ignore` and `policy.json` are still read, as in v8.1.0. Git
+  clones, submodules, worktrees and temp-directory clones are covered. Without
+  git there is no general way to tell a fetched folder from your own; a
+  narrower rule for known install locations is being considered.
+- The posture scanner credits a `policy.json` that exists even when the scan
+  would not honour it.
 
 ## [8.1.0] - 2026-09-22