v1.0.0

package-boost-php is now SemVer-stable. The public surface declared in
PUBLIC_API.md
is locked for the 1.x line:

• the AutoSync composer-hook façade (run / runWithSummary),
• the bin/package-boost-php CLI contract (the gitattributes / lean
  command names, their options, and exit codes),
• the # >>> package-boost (managed) >>> managed-block marker format.

Everything marked @internal remains free to change.

Breaking

• sandermuller/boost-core constraint narrowed to ^1.0 (from
  ^0.20 || ^0.21 || ^0.22 || ^0.23), dropping the boost-core 0.x line.
  boost-core 1.0.0 is a drop-in over 0.23.3 (no API break), so the bump is
  mechanical — composer require sandermuller/boost-core:^1.0. The
  surfaces this package consumes (the BoostAutoSync hooks, the
  BoostBaseCommand @api helpers, the boost.php authoring API) are
  frozen and unchanged. See
  UPGRADING.md.

No source/behavior changes — the package's runtime behavior is identical to
0.20.x. This release formalizes the API surface and aligns the dependency
floor with boost-core's own 1.0 freeze.

Full Changelog: 0.20.0...1.0.0