feat: prepare the stable release

[tensornull]

What changed

• execute all four canonical README examples unchanged against isolated wheel and sdist installs using deterministic loopback fixtures
• configure and validate the one-time Release Please recovery-alpha boundary so the next candidate is exactly 0.1.0
• call the protected publish workflow directly after bounded immutable-release verification, preserving exact tag/commit, live-smoke, PyPI OIDC, and registry gates
• make CI and current development commands version-neutral while preserving historical alpha evidence

Why

Stable 0.1.0 requires executable documentation evidence and a safe bridge from the recovery alpha. Releases created with the workflow token do not trigger a second release-event workflow, so the guarded reusable publication chain avoids silently stranding the release.

Validation

• uv lock --check; uv sync --locked
• Ruff check/format, Pyright, 232 non-live tests
• version, public-content, secret/scope, workflow semantic checks
• actionlint 1.7.12 online and offline
• wheel and sdist build, twine/artifact checks, isolated package and README example smokes
• copied standalone repository verification
• independent adversarial review: no remaining blocker/high risk