Bump version to 2.1.1

[jrothrock]

Patch release 2.1.1. Bumps the version in package.json and adds the corresponding CHANGELOG.md entry — matching the file set of previous bump PRs (#370, #345, #342).

Security

• Removed the download dependency; core-agent download/extraction now uses Node's built-in https/zlib plus tar-stream, eliminating the vulnerable decompress, got, and http-cache-semantics transitive dependencies, and adding path-traversal ("zip slip") protection. (Remove download dependency to resolve transitive security findings (#373) #374)
• Moved the test-only tmp dependency to devDependencies (bumped to 0.2.7), removing it from production installs. (Remove download dependency to resolve transitive security findings (#373) #374)

Stacking / merge order

This is stacked on the yarn.lock sync (#375), which is stacked on the fix (#374):

1. Remove download dependency to resolve transitive security findings (#373) #374 — remove download dependency
2. Sync yarn.lock self-reference to 2.1.1 #375 — sync yarn.lock self-reference to 2.1.1
3. Bump version to 2.1.1 #376 — this bump

Merge #374 → #375 → #376 into master in order (GitHub will retarget each to master as its base merges). Then tag v2.1.1 on master to trigger the publish workflow.

🤖 Generated with Claude Code