task: #3621161 Set the recipe version to 1.0.0-rc1 and re-pin the cross-dependencies

Plan issue: #3621161

Sets the recipe version to 1.0.0-rc1 and returns every cross-dependency to a published constraint after the Back to DEV change.

What changes

• composer.json: version 1.0.x-dev → 1.0.0-rc1, and all 17 cross-dependencies off 1.0.x-dev.
• README.md: version badge and the Composer install command → 1.0.0-rc1.
• CHANGELOG.md: a 1.0.0-rc1 section.

Why rc1 carries no functional change

There is one commit on 1.0.x since 1.0.0-beta1, the Back to DEV task. rc1 is a maturity promotion, not new work, and the notes say so rather than implying features.

The promotion is a step toward the 1.0.0 stable release, so that the Horizon Aid site template recipe works with Drupal CMS by default, on stable releases. Today a site builder has to loosen minimum-stability to dev for drupal/horizonaid:~1 to resolve, because every published version is still a pre-release. The constraint itself is not the blocker: ~1 normalizes to >=1.0.0.0-dev <2.0.0.0, so a pre-release does satisfy the range once the stability setting permits it. Once 1.0.0 stable exists, composer require drupal/horizonaid works against a stock drupal/cms root with its default minimum-stability: stable and no extra configuration.

Cross-dependency constraints

All seventeen are ~1.0.0 — the sixteen varbase_*_base recipes and drupal/vartheme_bs5_horizonaid. No constraint names a pre-release floor.

That works even where a stable release does not exist yet. ~1.0.0 normalizes to >=1.0.0.0-dev <1.1.0.0, so it matches varbase_auth_base at 1.0.0-rc1 and the theme at 1.0.0-rc1, and it will float up to 1.0.0 on each as those land — a stable sorts above its own pre-releases. Fifteen of the sixteen varbase_*_base recipes already publish a stable 1.0.0.

The one thing ~1.0.0 cannot do is express a minimum pre-release, since its effective floor is 1.0.0-dev. Nothing here needs one.

Every version was checked against updates.drupal.org/release-history/<project>/current, not the tags API.

Install evidence behind the promotion

Two fresh browser installs of the released tag passed today, both on ~1 resolving to 1.0.0-beta1:

• Drupal CMS base: all paths 200, 70 nodes (26 blog, 12 country, 24 event, 3 page, 5 program), 8 Canvas pages, 74 media, 25 terms, 248 extensions, home 21 images / 0 broken / 0 console errors, zero type: php watchdog rows, no rescue drush cr.
• Varbase project base: identical on every metric, and require needed no -W.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release