Prepare Tink 1.0 release candidate

[jon-devlapaz]

Summary

• automate the remaining v1 acceptance proof gaps without broadening their claims
• guard Tink's Git process boundary against project-mutating commands
• support intentional pre-bumped major releases without accidental patch increments
• prepare the package and documentation as a 1.0.0 release candidate

Verification

• cargo fmt --all -- --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --all-targets --locked
• cargo test --workspace --locked --doc
• cargo build --workspace --release --locked
• cargo audit --file Cargo.lock
• bump-release shell block parses with bash -n

Boundary

This PR does not merge, tag, or publish v1.0.0. Public release remains a separate human go/no-go decision.