v1.0.0-rc.1

What's Changed

• fix(doc-gate): stop requiring internal audit closeout by @msambare in #8
• docs(readme): remove retired Go Report Card badge by @msambare in #9
• docs: v1.0 prep — compliance counts, orphaned pages, mcp-server reference by @msambare in #10
• fix(pathguard): restore Windows build with best-effort confined open by @msambare in #11
• feat(release): supply-chain hardening — SBOM, cosign, provenance, GHCR images by @msambare in #13
• ci(e2e): run kind+bats e2e suite nightly and on demand by @msambare in #12
• feat(ci): first-party GitHub Action for manifest scanning by @msambare in #14
• docs(release): v1.0.0 changelog, release notes, and governance updates by @msambare in #15
• ci(e2e): fix bats install permissions and teardown flag by @msambare in #16

Full Changelog: v0.5.0...v1.0.0-rc.1