task: #3620964 Set the Horizon Aid site template recipe version to 1.0.0-alpha2 and pin every cross-dependency to a released constraint

Release bump for Horizon Aid 1.0.0-alpha2.

• composer.json version -> 1.0.0-alpha2.
• Every cross-dependency pinned from 1.0.x-dev to its own published pre-release floor. A pre-release sorts below its own release, so ~1.0.0 cannot floor an -rcN/-betaN/-alphaN; each constraint therefore names its own pre-release.
• drupal/vartheme_bs5_horizonaid -> ~1.0.0-alpha4 (released today).
• README version badge and Composer install command -> 1.0.0-alpha2.
• CHANGELOG entry for 1.0.0-alpha2.

The pin set was proven resolvable with a composer update --dry-run against packages.drupal.org: every pinned package resolves to exactly the pinned version, with no conflicts.

AI-Generated: Yes

Plan issue: #3620964

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release