chore(release): prep for v1.0.0 — pom bump, manifest version, README pin, CHANGELOG

[VirusAlex]

Summary

Final prep before tagging v1.0.0. Three things, all paving the way:

1. pom.xml version 0.4.0-SNAPSHOT → 1.0.0-SNAPSHOT

From v1.0 onward, wire formats and CLI flags are part of the contract; breaking either requires a major bump. Already enforced by:

• schemaVersion=1 on every persisted file (<state-dir>/jobs/*.json, <file>.netcopy/meta.json) — readers refuse anything higher.
• ArchUnit no-delete invariant.
• The release-time rewrite of pom version (./mvnw versions:set -DnewVersion=$VERSION) means tagged releases publish with the correct version regardless.

2. Fix the manifest-version pre-existing bug

App.versionString() reads Class.getPackage().getImplementationVersion() from the bundled jar manifest. The maven-shade-plugin's ManifestResourceTransformer didn't actually write that entry, so on every local build the helper fell back to the hard-coded 0.1.0-SNAPSHOT. Tagged releases shipped correctly only because the workflow rewrites pom-version-per-tag before the package step.

Result: local java -jar netcopy.jar --version always lied. Now: <manifestEntries> block bakes Implementation-Title=NetCopy + Implementation-Version=${project.version} into the jar, so every build (local or CI) reflects the truth — including the new UI version chip from #70.

3. README + CHANGELOG

• README: docker-pin example 0.3.2 → 1.0.0; :latest table reworded to clarify it tracks stable 1.x+ (matches the !startsWith(version, '0.') gate in release.yml).
• CHANGELOG: v1.0.0 entry summarising the audit-driven journey from 0.x and explicitly calling out the stability commitments (wire formats, CLI flags, security model).

Test plan

• Local mvn package: target/netcopy.jar --version now prints netcopy 1.0.0-SNAPSHOT (was 0.1.0-SNAPSHOT for every build prior to this PR).
• ArchUnit 8/8.
• CI green.

Follow-up

After this lands → git tag -a v1.0.0 → release.yml will:

• Push ghcr.io/virusalex/netcopy:1.0.0 AND :latest (the !startsWith(version, '0.') gate flips on for the first time).
• Mark the GH Release as make_latest=true (also gated the same way).
• Set prerelease=false for the first time.

🤖 Generated with Claude Code