chore: release 1.0.0

[rogerdigital]

Version promotion

Bumps the synchronized version set to 1.0.0 via the existing npm version lifecycle (package.json, package-lock.json root, manifest.json, versions.json → minAppVersion 1.7.2 mapping, cli/version.ts). Functional fixes live in the already-merged PRs #179–#182; this PR changes version metadata only.

What ships in 1.0.0

• Correctness: atomic link fixes (vault.process), unverified-not-confirmed link findings for unavailable target metadata and implicit block references, Obsidian-compatible heading-anchor matching, hierarchical-tag tree semantics, external-URL boundary trimming.
• Safety: metadata write fence — verification waits for the mutation's own cache events; batches poison on timeout and tell the user to rescan instead of trusting stale metadata.
• CLI: strict JSON-config boundary validation (exit 2 before scanning); comparison semantics version 4 (older baselines exit 2 with semantics-changed).
• Release engineering: Node 18/24 installed-package matrix in CI (required checks), tag/version/ancestry gates and full re-verification in the release workflow.

Validation

• node scripts/check-release-version.mjs 1.0.0 — all five version sources agree.
• C5 gates on this commit: lint, obsidian lint, build, test:coverage (969 tests, 82.9% lines), npm pack --dry-run (8 files).
• B2 installed-package smoke on the packed 1.0.0 tarball: Installed CLI smoke passed on v24.16.0 — tarball vault-inspector-1.0.0.tgz, integrity sha512-9mr4AediFPxEXX15CAmKvJUks…, shasum 0c04708bee6e5bf57ce903bc4076aa36ae38ee43.
• Native acceptance (C1–C3) remains Blocked — see docs/validation/1.0.0-readiness.md. Merging/tagging is gated on the release decision recorded there.