Prepare sbom-diff-and-risk v1.0-rc.1 evidence

[stacknil]

Summary

• add a fixed one-page policy warning reviewer case for the new_package warning path
• bump sbom-diff-and-risk package metadata to 1.0rc1 and add v1.0-rc.1 release notes
• update reviewer docs, consumer workflow examples, and SARIF fixtures for the rc
• mark rc tag releases as GitHub prereleases and prefer tag-specific release notes in the release workflow

Validation

• python -m pytest from tools/sbom-diff-and-risk -> 182 passed
• python scripts\regenerate-example-artifacts.py --check from tools/sbom-diff-and-risk -> all checked example artifacts are up to date
• python scripts\validate-reviewer-routes.py from repo root -> passed
• python -m build from tools/sbom-diff-and-risk -> built sbom_diff_and_risk-1.0rc1 wheel and sdist
• python -m twine check dist\* from tools/sbom-diff-and-risk -> PASSED for both artifacts
• git diff --cached --check -> passed

Boundaries

• release candidate only; not final v1.0.0
• no production PyPI publishing
• no CVE scanner, malware scanner, or package safety verdict claim
• no hidden network enrichment added

Privacy/security

• scanned changed and untracked files for local paths, personal identifiers, key/token patterns, and GitHub token patterns; no matches