release: finalize 1.0.0 stable contract and package surface

[GazaliAhmad]

Summary

Finalize the 1.0.0 release line by promoting the current runtime to a stable public contract, removing the last transitional root helper alias, and aligning the package-facing docs, release metadata, generated API surface, and ecosystem positioning around the shipped stable line.

Why

This change belongs now because 0.9.0 already served as the final stabilization release, and the remaining work is the actual stable release cut rather than more contract design.

• it addresses the gap between the already-hardened package behavior and the repo still speaking in pre-1.0.0 posture
• this is 1.0.0 milestone work: the stable public release after the 0.9.x final stabilization line

Included

• bump package metadata to 1.0.0
• remove compareClocks() from the root surface after the 0.9.x deprecation line
• update root-surface tests to lock the 1.0.0 helper posture
• add docs/releases/1.0.0.md
• align README, CHANGELOG, ROADMAP, MAINTENANCE, COMPATIBILITY, and upgrade guidance with the stable line
• refresh generated API metadata and publish-footprint artifacts
• clarify the package ecosystem in package-facing docs, positioning causal-order as the core runtime and @causal-order/dedupe as a companion package
• preserve the previously working npm README badge path/rendering behavior

Not Included

Call out anything intentionally left out so the PR does not read larger than it is.

• new contradiction-resolution semantics inside the payload-agnostic core
• built-in entity-fork or semantic-dedupe policy runtimes
• deployment-specific adapters or transport glue inside the main package
• new streaming truth claims beyond the current watermark/lateness/correction/reconciliation contract
• website design/system refactors unrelated to the 1.0.0 release surface

Verification

List the exact checks or commands you ran.

npm run check
npm test
npm run badge:footprint
npm run badge:footprint:check
npm run docs:sync:check
npm run release:check
npm publish --dry-run
npm pack --dry-run
npm view causal-order version time --json

Website-specific verification attempted:

npm run site:build

Note: npm run site:build is currently blocked by a locked website/dist/404-broken-doc.svg cleanup issue and is not part of the npm package publish path.

Docs

Mark what was updated if the public behavior, release posture, or surfaced site changed.

• README
• CHANGELOG
• ROADMAP
• MAINTENANCE
• RELEASE_PROCESS
• COMPATIBILITY
• guides
• website
• no docs change needed

Checklist

• scope stays focused
• verification matches the change
• docs and release wording are aligned when needed
• no unrelated changes were bundled in casually