v1.0.0

ci: build the workspace before the release tests, let audit report

Two separate red jobs on 98fe9b4, both workflow config rather than code.

release.yml's `test` job ran `cargo test --workspace --locked` with no
prior build, so mcp_smoke panicked at mcp_smoke.rs:55 with "missing binary
target/debug/copycatd". That test spawns the real binaries out of the
target dir, which is why ci.yml's build-test job already has a `Build`
step ahead of `Test`; release.yml never got the same treatment. Verified
it was not a cache flake: rerunning the job failed identically, while
ci.yml's build-test passed on the same commit with the same test command,
which leaves the missing step as the only difference. The `build` job was
gated on `test`, so the v1.0.0 tag shipped nothing.

ci.yml's `audit` job failed on "Resource not accessible by integration"
when rustsec/audit-check tried to create a check run. The scan itself was
clean ("No vulnerabilities were found"); only the reporting call was
denied, because the job inherited a read-only token. Granting `checks:
write` (and keeping `contents: read` explicit, since naming one permission
drops the rest) fixes the report without touching the scan.

The 10 informational advisories the scan does report, 8 unmaintained and 2
unsound, are the archived gtk3-rs stack plus proc-macro-error and
memmap2. They are non-blocking and deny.toml already covers the policy, so
they stay as they are here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>