Prepare v1.0.0-rc.3 release

[hazennik]

Summary

• move the completed audit fixes into the v1.0.0-rc.3 changelog
• update the README release-candidate download and Sparkle test baseline

Safety

• No permanent delete path added.
• Cleanup still uses Trash or approved simctl actions.
• Active simulators remain protected.
• Docs updated if safety behavior changed.
• No personal signing identity or Team ID committed.
• Privacy-sensitive behavior reviewed if new paths, process data, or metadata are read.

Validation

• make lint (passed on the release source commit)
• make workflow-check (passed on the release source commit)
• make repository-check (passed on the release source commit)
• make docs-check
• make icon-check (passed on the release source commit)
• make homebrew-check (passed on the release source commit)
• make script-test (passed on the release source commit)
• make test (passed on the release source commit)
• make swift-test (passed on the release source commit)
• make analyze (passed on the release source commit)
• make cli-dry-run (passed on the release source commit)
• make package-check (passed on the release source commit)
• make appcast-check (passed on the release source commit)
• make spark-sign-check (passed on the release source commit)
• make ui-test (passed on the release source commit; no UI code changed here)