chore: release 1.1.1

Patch rather than minor: the error surface is unchanged and no public
signature moved. What downstream must notice is timing, not types — the
worst-case call duration rises to roughly max_attempts * timeout_s now
that the retry budget actually applies.

Pre-release review caught an overreaching promise in the changelog entry:
the 429 bound holds only when the stall verdict can fire at all, i.e. when
the whole scope has no progress. The verdict is a conjunction, so a call
does not die while other calls in the scope are still producing — by
design — which leaves no hard per-call ceiling in that case. That property
predates this fix and is now stated with its precondition instead of as an
unconditional guarantee.

The wiki sync in the release checklist is a no-op again: the doc site has
been down since 2026-08-02 and its landing page names CHANGELOG.md as the
version source of truth, which this commit updates.

tests/unit/test_backpressure.py

@@ -383,7 +383,14 @@ class TestStallBudget:
         assert (first.content, second.content) == ("first", "second")
 
     async def test_concurrent_calls_do_not_share_clock(self):
-        """并发两路共用同一个 mw: 一路长尝试不得污染另一路的 stall 账。"""
+        """并发两路共用同一个 mw: 一快一慢都能正常完成(形态冒烟)。
+
+        **这条不是回归防线**: 实测它在"clock 提为实例属性""去掉 refund""去掉
+        生产性扣减"三种变异下均保持绿色——共享 clock 时慢调用的耗时是作为
+        credit 记进共享账的,污染方向是让 stall 账**变小**(更宽松),而本用例
+        断言两路都成功。真正钉住调用级隔离的是上面那条
+        `test_clock_is_per_call_not_per_instance`。保留此条只为覆盖并发形态。
+        """
         clock = FakeClock()
         src = make_source(max_concurrency=2)
         limiter = InMemoryLimiter(