Prepare the stable 1.0.0 release

[hokoo]

Outcome

Prepare the stable 1.0.0 release without publishing it.

Part of #24.

Changes

• Freeze the post-RC hosted-distribution correction as
  ## [1.0.0] - 2026-09-11.
• Add the new empty Unreleased section and exact comparison links.
• Close E4 in the delivery plan after T14/T14a independent QA and record the
  owner's accepted exact-stable-target route without rc.2.
• Move T15 to active preparation and record its local, hosted-archive, and
  independent review evidence.

No runtime, public API, dependency, platform, workflow, test, localdev, or
package-policy source changes are included.

Release intent

• Version: 1.0.0
• UTC date: 2026-09-11
• Previous version: 1.0.0-rc.1
• Extracted notes: 209 bytes
• Notes SHA-256:
  057ad95f9a44421bf24dd795d8a39bf132daac1ce19fa44b7fe5a754a47c2fa3
• Tag and GitHub Release 1.0.0: confirmed absent during preparation.

This PR does not dispatch the Release workflow and does not authorize
publish=true.

Verification

Gate	Result
make check	PASS — 70 tests / 970 assertions
make coverage	PASS — 192/192 lines, 43/43 methods
make test.package-install	PASS — Git and Composer archives, 8 roots, 19 methods, zero dev
make smoke	PASS — persistent WordPress lifecycle
Minimum integration	PASS — WP 6.0 / PHP 7.4.33, 16 groups, zero fixtures/logs/resources; minimum-20260911T165030Z-7801-192
Latest integration	PASS — WP 7.1 / PHP 8.4.25, 16 groups, zero fixtures/logs/resources; latest-20260911T165104Z-8804-12525
Composer audit	PASS — no advisories
actionlint 1.7.12 / syntax / diff	PASS
Exact preparation SHA hosted ZIP	PASS — 41f2403996669d2ad866ae0a74013407c0aa09a8, 82,248 bytes, SHA-256 06717daaed545b3d7f12aa123944d7a19f81a7ae680bf2ae150d6ffc97429444
Exact final head hosted ZIP	PASS — 8694c9e27adcd90f384a98c52a22b0c4dfdc51c1, 82,772 bytes, SHA-256 58bf5f6503b687e462342d3c68c4a24e1683a1542199fe78e6e5372181eb9387

Each hosted ZIP passed the same complete three-artifact runner: exact target,
eight allowed roots, installed public-symbol provenance, frozen 19-method API
and private seams, classmap-authoritative no-dev install, and zero development
packages.

Independent review

Independent E5 preparation QA reviewed exact commit 41f2403 against base
26f4d03, repeated the release-intent and proportionate test gates, and found
zero blocker, high, medium, or low findings. The subsequent commit changes only
the delivery-plan evidence and the exact pushed head passed the hosted package
gate again.

Remaining gates

1. All five required PR checks on exact final head.
2. Protected merge and all five post-merge checks on exact master.
3. Non-mutating Release workflow with publish=false for exact
   1.0.0 / merged full SHA / current UTC date.
4. Fresh immutable-release, actor, target, and absence checks.
5. Separate owner approval for that exact tuple before publish=true.
6. Immutable GitHub and exact Packagist/install verification after publication.

If the UTC date changes before the dry run, the changelog date and release tuple
must be updated in a new reviewed commit.