Docs + GA 1.0.0: consumer integration (closes #4, #5, #6, #7)

[moisesja]

Addresses the four open consumer-integration issues for net-did's adoption of NetCrypto as its single crypto foundation. Mostly documentation; one release-channel change (GA).

#5 — Stabilize to a non-preview 1.0.0 (GA)

• NetCryptoVersion 1.0.0-preview.3 → 1.0.0 (plain SemVer = stable, non-prerelease).
• Shipped the public API: moved the BBS header additions from PublicAPI.Unshipped.txt into PublicAPI.Shipped.txt; Unshipped is now empty (the analyzer-enforced "frozen contract" the issue references is now literally true).
• README: dropped the --prerelease install flag; documented GA status + the frozen-API / SemVer policy.
• (This branch is based on main after PR Harden malformed key inputs → parameter-named ArgumentException (preview.3) #8 merged, so GA includes the preview.3 security hardening. Tag v1.0.0 after merge to publish.)

#4 — Native runtimes in the published .nupkg

• README: explicit supported-RID matrix (osx-arm64/x64, linux-x64/arm64, win-x64) with library filenames + CI coverage; documents that the package ships runtimes/{rid}/native/ transitively (zero per-consumer native assets), that release CI fails if any RID's payload is missing, and that the packed .nupkg is smoke-tested (BBS round-trip) — i.e. verified against the published artifact, not the source tree.
• The verification infra already existed in release.yml (the "Verify nupkg contains all five RIDs" step + the smoke job); this surfaces and documents the guarantee. AC "platform matrix documented" + "IsAvailable on each RID" are now covered.

#6 — BBS keygen path (documentation)

• README + DefaultBbsCryptoProvider XML docs: the supported keygen path is DefaultKeyGenerator.Generate(KeyType.Bls12381G2) / Bls12381G1; raw FFI keygen is intentionally internal (no public raw-keygen helper — the frozen-surface posture). No API change.

#7 — EC validation surface (confirmation)

• README + EcPointValidator XML docs: EcPointValidator.EnsureOnCurve is the public EC on-curve validation entry point; point decompression (DecompressEcPoint / DecompressSecp256k1Point) is an internal implementation detail, not public. No API change.

Verification

• dotnet build NetCrypto.sln -c Release clean — PublicAPI analyzer green (Shipped matches the surface, Unshipped empty), no XML cref warnings.
• Native-present leg (--filter "Category!=BbsAbsent") → 786/786 passed.
• Version resolves to 1.0.0.

After merge

Tag v1.0.0 to trigger the release workflow (packs all 5 RIDs, verifies the nupkg, smoke-tests, publishes to NuGet as the GA package).

🤖 Generated with Claude Code

[moisesja]

Automated review (post-merge — this PR was already merged by the time the review routine ran, so this is a record, not a gate).

Assessment: LGTM. Low-risk, well-scoped change. No concerns.

What I checked:

• Scope is documentation + a release-channel bump; the only "code" deltas are XML doc comments (DefaultBbsCryptoProvider, EcPointValidator) and the PublicAPI baseline files — no behavioral changes.
• API freeze is internally consistent on merged main: PublicAPI.Unshipped.txt is now empty and the BBS header/presentationHeader signatures landed cleanly in PublicAPI.Shipped.txt (the *REMOVED* churn is just the analyzer's unshipped→shipped promotion, not a contract change). The analyzer would have failed the build otherwise.
• Version: Directory.Build.props resolves to a plain 1.0.0 (non-prerelease), matching the GA narrative and the --prerelease-flag removal in the README.
• Tests: none added, which is appropriate here — the BBS header surface this PR ships was already test-covered in the preview.2 work; this PR adds no new behavior to test.

Minor (non-blocking, no action needed): the CHANGELOG.md history jumps preview.2 → 1.0.0 and folds in the unpublished preview.3 hardening — intentional and clearly explained in the changelog body, just flagging that the [1.0.0] compare link spans v1.0.0-preview.2...v1.0.0.

Reminder from the PR description: tag v1.0.0 to trigger the release workflow (packs all 5 RIDs, verifies the nupkg, smoke-tests, publishes the GA package).

---

Generated by Claude Code