feat(sbom): prepare v1 final release surface

[stacknil]

Summary

• choose the v1 release policy: stable GitHub v1.0.0, production PyPI deferred
• finalize evidence confidence labels with scorecard_recorded
• carry the fixed new_package policy warning through JSON, Markdown, and SARIF
• put the three supply-chain non-claims on the README first screen
• prepare 1.0.0 package metadata, release notes, consumer pin, and final-tag Latest behavior

Validation

• python scripts/validate-reviewer-routes.py
• python scripts/regenerate-example-artifacts.py --check
• python -m pytest (185 passed)
• python -m build --outdir <temporary-directory>
• python -m twine check <temporary-directory>/*
• git diff --cached --check
• staged privacy, local-path, identity, private-key, and literal-credential scans

Release boundary

This PR prepares the final release surface. It does not create v1.0.0, publish a GitHub Release, or enable production PyPI publishing.