release: cut v1.0.0

Prepare the first public 1.0.0 release and finish the remaining CI hardening work.

Highlights:
- align Python, Rust, WASM, Conda, API, MCP, and docs version metadata to 1.0.0
- promote package metadata to Production/Stable and update stability/versioning docs for the stable series
- move the accumulated Unreleased notes into a dated 1.0.0 changelog section and keep a fresh top-level Unreleased block
- strengthen the changelog checker so it validates a single top-level Unreleased section
- fix the CI/package support mismatch by declaring Python >=3.10 consistently and gating pandas-ta extras to Python 3.12+
- restore Sphinx autodoc compatibility for documented ferro_ta.<module> imports by registering module aliases
- make the TA-Lib benchmark guardrail less flaky by checking median and tail-percentile speedups instead of failing on a single mild outlier
- switch PyPI publishing to OIDC-only trusted publishing and wire the changelog check into the required CI gate
- apply the Ruff-driven cleanup across the Python and test tree and refresh uv/cargo lockfiles

Validated locally:
- python3 scripts/check_changelog.py
- uv run --with ruff ruff check python tests
- uv run --with ruff ruff format --check python tests
- uv lock --check
- sphinx-build -b html docs docs/_build -W --keep-going
- build/install the ferro_ta 1.0.0 wheel successfully

.github/workflows/CI.yml

@@ -11,7 +11,6 @@ on:
 permissions:
   contents: read
   pages: write
-  id-token: write
 
 jobs:
   # -------------------------------------------------------------------------
@@ -386,6 +385,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - audit
+      - changelog-check
       - version-check
       - rust
       - rust-core
@@ -452,6 +452,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build-wheels
     if: github.event_name == 'release' && github.event.action == 'published'
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ferro-ta
     permissions:
       id-token: write
     steps:
@@ -464,10 +467,6 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          # Use token if set; otherwise the action uses OIDC trusted publishing
-          username: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
   # -------------------------------------------------------------------------
   # Publish ferro_ta_core to crates.io (requires CARGO_REGISTRY_TOKEN secret)