v1.0.0 — working velocity.toml, pinned proxy image, CI verification

First semver release, and it fixes a config that was silently ignored: velocity.toml was mounted over the /config directory itself, which the itzg image does not read. Velocity booted with its defaults and listened on 25577 while the compose published 25565, so the proxy never answered on the advertised port. The file is now mounted as /config/velocity.toml, which the image copies into /server on startup, one mount that works on every OS (the old per-OS comment block is gone).