Complete the 1.0 conformance and security release gates

[RejectKid]

What changed

Audited conformance

• adds a machine-readable 1.0 audit manifest covering all 72 PDU types, 12 protocol families, and 233 concrete wire classes
• pins 13 DIS schema inputs, the SISO v36 catalog, both independent vector corpora, and the frozen public API with cross-platform SHA-256 identities
• verifies every PDU identifier is accounted for exactly once and matches the factory's protocol family
• publishes a reviewable audit report with exact coverage, limitations, and documented differential exceptions
• adds hostile-input regression coverage: 10,000 deterministic random datagrams plus three byte mutations at every byte of every populated PDU

Compatibility

• advances NuGet package compatibility validation from 0.8.0 to the published 0.9.0 baseline
• retains the compiler-enforced shipped public API contract
• validates a complete 1.0.0 package through NuGet-only consumers on .NET 9 and .NET 10

Security and supply chain

• explicitly audits direct and transitive NuGet dependencies at low-or-higher severity
• adds pull-request dependency review with low-severity failure threshold
• retains pull-request and weekly CodeQL analysis
• requires release tag commits to be contained in main
• creates SHA-256 package checksums
• generates GitHub build-provenance attestations before OIDC trusted publishing
• documents parser limits, consumer rate limiting, supported-version policy, and attestation verification

Audit qualification

This is a project-maintained engineering audit, not IEEE/SISO certification or government approval. The report explicitly preserves two default reference differential cases and 28 malformed populated reference outputs rather than modifying the native C# codec to reproduce reference-generator defects.

No Java code, dependency, runtime, or Java-facing API is included.

Validation

Clean-clone release simulation:

• locked restore with transitive NuGet vulnerability auditing passed
• generator verification passed: 233 classes and 72 PDUs
• Release build passed with 0 warnings and 0 errors
• 308 tests passed
• hostile-input and audit tests passed
• 1.0.0 package compatibility against 0.9.0 passed
• NuGet-only consumer passed on .NET 9 and .NET 10
• formatting and diff checks passed

The 1.0.0 tag should be created only after this PR is reviewed, merged, and all live GitHub security checks are green.