task: #3624649 Release The Rightup 1.0.0-alpha1

Closes #3624649.

Prepares drupal/rightup 1.0.0-alpha1: the version bump and the cross-dependency pins the release needs.

composer.json

• The thirteen varbase_*_base pins move from 1.0.x-dev to ~1.0.0. Every one of them has a tagged release, so RightUp no longer forces their development branches on a site.
• drupal/vartheme_bs5_rightup moves to ~1.0.0-alpha1, not ~1.0.0. A pre-release sorts below its own release, so ~1.0.0 cannot match 1.0.0-alpha1: under the distro's minimum-stability it would resolve some pre-release but could not guarantee this one. The theme's 1.0.0-alpha1 is released and tagged at ce2d7d7.
• Adds drupal/canvas: ~1.11.0 and drupal/better_exposed_filters: ~7. recipe.yml installs canvas_page_template_component and better_exposed_filters, but nothing required either project, so they arrived only transitively and through the base projects' committed lock files. That is exactly the kind of undeclared dependency that breaks when the other pins are tightened. On the versions: canvas_page_template_component has existed since Canvas 1.6.0, so this is not a 1.11-only requirement. ~1.11.0 and ~7 are the versions both verified installs actually ran.
• Sets version to 1.0.0-alpha1.

Docs

• README badge to 1.0.0-alpha1, and the badge and title read RightUp rather than Rightup.
• CHANGELOG entry for 1.0.0-alpha1, including the merged issues that were not yet logged.

Verification

Built and installed the way a user does, under these exact constraints, on the Drupal CMS base (drupal/cms 2.1.4), with the recipe mirrored from the 1.0.x tree:

• drupal/vartheme_bs5_rightup resolves to the tag 1.0.0-alpha1, not the dev branch.
• All thirteen base recipes resolve to releases, and varbase_components (4.0.1), varbase_media (11.0.0) and varbase_recipes (1.0.0) come off their dev branches too.
• drupal/canvas 1.11.0 and drupal/better_exposed_filters 7.1.3 install through the new requires.
• No package in RightUp's own dependency tree is left on a development branch.
• Install completes with zero errors and no missing content files: 42 nodes, 17 Canvas pages, search and facets working.

AI disclosure

AI-Generated: Yes. Prepared with Claude Code, per the Policy on the use of AI when contributing to Drupal. Reviewed and verified by a human against a real install before opening.

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release