release: 1.0.0 -- the exported Python surface is frozen under semver

Nine current-state surfaces bumped by hand. The classification sweep ran
FIRST, before the first edit: 421 hits on 'v?0.N(.N)' across all tracked
files, each read and sorted current-state vs provenance. Provenance is
untouched -- 'New in v0.4.0', 'measured against 0.3.1', every '0.7.0'
in a code comment or a census candidate name still says what it measured.

The sweep found two surfaces the plan's nine-item list did not name:
README's status BADGE (still 'alpha' -- a version string grep cannot see
it) and ADOPTION-BRIEF's test count, which said 791 against a suite that
runs 792. Both corrected.

pyproject also moves Development Status :: 3 - Alpha -> 5 -
Production/Stable, likewise invisible to a version grep.

CHANGELOG [1.0.0] references [0.3.0] and [0.3.1] for the behaviour
changes rather than repeating them, and carries the freeze point itself:
what is frozen (the exported surface), what is deliberately NOT (all
detection calibration), the three conceded limitations, the one known
open defect (:43), and the runtime-coverage gap -- no external consumer
has run 0.7.0.

No code changed. Per docs/PLAN-v1.md the release gate is the whole suite
green, not a new test: 792 passed, coverage matrix 129/129 + 6/6, exit 0.

README.md

@@ -2,8 +2,8 @@
 
 Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
 
-![Version](https://img.shields.io/badge/version-0.7.0-blue)
-![Status](https://img.shields.io/badge/status-alpha-orange)
+![Version](https://img.shields.io/badge/version-1.0.0-blue)
+![Status](https://img.shields.io/badge/status-stable-brightgreen)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
@@ -33,17 +33,20 @@ at write time, never assumed from the format. Any pipeline ingesting external da
 into an agent-read store has this shape; an OKF wiki is its canonical form — which
 is why the guard ships a first-class OKF adapter (below).
 
-**Status:** `v0.7`, alpha. The stdlib-only core — its detector, contract, and
+**Status:** `v1.0.0`. The stdlib-only core — its detector, contract, and
 OKF-adapter modules plus the top-level wiring — is built and tested, exercised by
-an end-to-end showcase and adversarial + false-positive corpora. The public API
-may still change. There are real limitations, stated plainly below; read them.
+an end-to-end showcase and adversarial + false-positive corpora. The exported
+Python surface is now frozen under semver: nothing exported is removed, renamed or
+given a different meaning without a `2.0.0`. **Detection behaviour is not frozen** —
+severities, thresholds and lexicon entries are calibration and move in `1.x`. There
+are real limitations, stated plainly below; read them.
 
 ## Install
 
 Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
 
 ```bash
-pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.7.0"
+pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.0.0"
 ```
 
 The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or
@@ -65,7 +68,7 @@ pip install -e ".[dev]" && pytest        # the whole suite
 Two consequences worth knowing before you depend on this:
 
 - A git URL is a PEP 508 *direct reference*: it pins one exact tag, not a range
-  like `>=0.2,<0.3`. Real range pinning — and therefore automatic pickup of patch
+  like `>=1.0,<2.0`. Real range pinning — and therefore automatic pickup of patch
   releases — arrives with a Forgejo PyPI registry, which becomes the durable
   channel at the first patch release or the second downstream consumer, whichever
   comes first. The distribution name (`llm-ingestion-guard`) and the version