Fresh tag at the same commit as the (now poisoned) v1.0.0. Functionally identical — only required because retagging v1.0.0 caused upstream Go module proxies to cache divergent zip hashes for the same version, breaking downstream consumers' go.sum verification.
From here onwards, treat tags as immutable: cut a new patch version for any change, never retag.