release: cut v1.0.0

Prepare the first public 1.0.0 release and finish the remaining CI hardening work.

Highlights:
- align Python, Rust, WASM, Conda, API, MCP, and docs version metadata to 1.0.0
- promote package metadata to Production/Stable and update stability/versioning docs for the stable series
- move the accumulated Unreleased notes into a dated 1.0.0 changelog section and keep a fresh top-level Unreleased block
- strengthen the changelog checker so it validates a single top-level Unreleased section
- fix the CI/package support mismatch by declaring Python >=3.10 consistently and gating pandas-ta extras to Python 3.12+
- restore Sphinx autodoc compatibility for documented ferro_ta.<module> imports by registering module aliases
- make the TA-Lib benchmark guardrail less flaky by checking median and tail-percentile speedups instead of failing on a single mild outlier
- switch PyPI publishing to OIDC-only trusted publishing and wire the changelog check into the required CI gate
- apply the Ruff-driven cleanup across the Python and test tree and refresh uv/cargo lockfiles

Validated locally:
- python3 scripts/check_changelog.py
- uv run --with ruff ruff check python tests
- uv run --with ruff ruff format --check python tests
- uv lock --check
- sphinx-build -b html docs docs/_build -W --keep-going
- build/install the ferro_ta 1.0.0 wheel successfully

RELEASE.md

@@ -3,7 +3,7 @@
 This document describes the step-by-step process for cutting a new **ferro-ta** release.
 Follow every step in order to produce a consistent, reproducible release.
 
-For **automated publishing** (secrets and what runs on release), see [PUBLISHING.md](PUBLISHING.md).
+For the packaging and release overview, see [PACKAGING.md](PACKAGING.md).
 
 ---
 
@@ -11,7 +11,7 @@ For **automated publishing** (secrets and what runs on release), see [PUBLISHING
 
 | Artifact    | How |
 |-------------|-----|
-| **PyPI**    | CI job `publish|
+| **PyPI**    | CI job `publish` using PyPI Trusted Publishing (OIDC) |
 | **npm (WASM)** | Workflow `wasm-publish`|
 | **crates.io** | CI job `publish-cratesio` |
 
@@ -129,7 +129,8 @@ git push origin v0.2.0
 5. Click **Publish release**.
 
 Publishing the release triggers the CI `build-wheels` and `publish` jobs
-automatically (the workflow responds to `release: published`).
+automatically (the workflow responds to `release: published`). The PyPI upload
+uses Trusted Publishing via GitHub OIDC, so no `PYPI_API_TOKEN` secret is used.
 
 ---