v1.0.0

fix(ci): grant contents:write to release job for GitHub Release publish

softprops/action-gh-release needs contents:write on GITHUB_TOKEN; with
no permissions block declared, GitHub defaults it to read-only and the
step 403s ("Resource not accessible by integration"). Notarization
credentials are confirmed working end-to-end (run 29801745144 signed,
notarized, and stapled successfully) — this was the only remaining gap.