v1.0.0-rc2

Added

• Added a tag-driven release gate that rechecks the primary-artifact contract
  and Windows Fast Lane contracts before publishing.
• Added a Windows MCP runtime gate with the same task-local environment
  contract used by CI; Linux continues to validate AstrBot and the primary
  artifact contract.
• Added retained GitHub Actions artifacts and checksums for both the primary
  MCP ZIP and the independently buildable AstrBot wheel and source
  distribution.

Changed

• Bumped the MCP-only plugin and AstrBot companion package together to RC2.
• Reduced the optional Codex skill surface to concise module manuals; runtime
  dispatch, policy, and validation remain in the MCP package.
• Pinned release-workflow Actions to audited full commit SHAs and prevented the
  publish checkout from persisting its token.

Fixed

• Marked release-candidate tags as GitHub prereleases rather than ordinary
  releases.
• Bound release metadata validation to the AstrBot package version as well as
  the primary plugin and MCP runtime versions.