1.0.0: first stable release

Promoted directly from beta1 after 10 days of clean production
soak on a real-traffic site (71 beacons captured at 10% sampling,
zero bugs surfaced). Skipping the rc1 ladder because the soak
window already provided the evidence rc1 was designed to gather.

The full alpha7 collector contract ships frozen and lived-with-
not-just-frozen. Five built-in report panels, two opt-in
correlation collectors (backend cache instrumentation,
render-tree size), synthetic edge-cache health probe, full
endpoint hardening (per-IP flood protection, server-side
sampling enforcement, max_rows table guard), production-tuned
defaults, SECURITY.md and PERFORMANCE.md.

Eligible for SA coverage application.

See ROADMAP.md, SECURITY.md, PERFORMANCE.md,
docs/collector-contract.md, and docs/vision.md for the full
picture.

Post-1.0 minor cycle reordered based on production soak feedback:
operator-pain features (outlier filtering, deploy annotations,
sampling improvements) bundle into 1.1.0; upstream request-id
correlation as 1.2.0; planned correlation collectors shift to
1.3-1.5; cwv_views to 1.6; the parked HMAC and async-queue
feature branches slot into 1.7 and 1.8; the diagnostic
recommendations engine remains the long-term moat at 1.9.