Publish wp-framework as a public, versioned package

[aryanjasala]

Why

wp-framework carries no version tags. Both starters pin dev-main against a committed lock SHA that is several commits stale, so framework changes do not reach consumers. Installation also requires WP_FRAMEWORK_REPO_TEMP_TOKEN, a personal-account PAT wired into every consumer's CI, which fails the moment its owner rotates credentials or leaves.

What

• Audit the full git history for secrets and client-identifying code. Remediate anything found before changing repository visibility.
• Make the repository public.
• Tag v1.0.0 and seed CHANGELOG.md.
• Both starters: resolve the framework through a vcs repository entry pointing at the public repo, require rtcamp/wp-framework ^1.0, remove the minimum-stability: dev workaround, regenerate composer.lock.
• Remove WP_FRAMEWORK_REPO_TEMP_TOKEN from all workflows and revoke the token.

Done when

• composer install succeeds on a machine with no credentials configured.
• Both starters resolve the framework through a version constraint, not a branch.
• The PAT is revoked and referenced nowhere in either starter.

Notes

wp-tooling receives the same treatment in rtCamp/wp-tooling#36. The consumer constraint changes land as PRs in the two starters, which close this issue using the cross-repo form Fixes rtCamp/wp-framework#<n>.

Gates rtCamp/wp-tooling#36, rtCamp/theme-elementary#734, and rtCamp/features-plugin-skeleton#721.