release: cut v1.0.1

Prepare the first patch release after v1.0.0 by finalizing the outstanding release, packaging, and workflow fixes.

This release keeps PyPI and crates.io publishing anchored to CI.yml, splits the large CI workflow into focused rust/python/wasm/docs suites, fixes the ci-complete gate, and updates the release SBOM action pin.

It also switches the npm publish workflow to GitHub OIDC, installs the wasm32 target required for packaging, ensures the WASM npm tarball includes pkg/ artifacts during prepack, and adds a dedicated README plus docs.rs metadata for ferro_ta_core.

Finally, bump all published package versions to 1.0.1 and record the patch release notes in CHANGELOG.md.

.github/workflows/wasm-publish.yml

@@ -4,6 +4,10 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   publish:
     name: Build and publish to npm
@@ -12,13 +16,15 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
       - name: Install Rust and wasm-pack
         uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
       - run: cargo install wasm-pack
 
       - name: Build WASM package
@@ -29,5 +35,3 @@ jobs:
       - name: Publish to npm
         working-directory: wasm
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}