chore(sbom): finalize v1.0.0 release

[stacknil]

Summary

• align root/tool/reviewer surfaces with the stable GitHub v1.0.0 release while keeping production PyPI deferred
• add an explicit v1.0-rc.1 to v1.0.0 compatibility note
• make source distributions reproducible by normalizing build timestamps before checksums and attestations
• lock package metadata, README status, SARIF fixture versions, and final-tag Latest behavior with tests

Validation

• python scripts/validate-reviewer-routes.py (13 documents, 79 Markdown files)
• python scripts/regenerate-example-artifacts.py --check
• python -m pytest (190 passed)
• two complete builds with the same SOURCE_DATE_EPOCH; wheel and sdist SHA256 matched byte-for-byte
• python -m twine check passed for wheel and sdist
• git diff --check
• staged privacy, local-path, identity, private-key, and literal-credential scans

Publication boundary

After this PR is merged and checks are clean, the explicitly authorized next action is to create and push annotated tag v1.0.0. The tag workflow will publish GitHub Release assets and attestations. Production PyPI remains deferred and is not part of this release.