v1.0.0 — first stable release

First stable release: the CLI and programmatic API built across 0.x are now committed to under semver. Includes a pre-1.0 security hardening — scenario-id path-traversal (assertSafeScenarioId rejects '..'/absolute ids). $0 deterministic replay, self-healing, depends_on + session snapshots, cross-browser/device, config.network/clock (global + per-scenario), rich expect asserts, runtime-health gates, CI guard-rails, diagnostics family, suggest-scenarios, and authoring via windup new or windup record.