Finalize GeoIntel 1.0.0 release identity

docs/RELEASE_RUNBOOK.md

@@ -7,8 +7,8 @@ the Kempen remain regression references. A successful release never implies
 that every theme is operational in every jurisdiction; the coverage API and
 source provenance remain authoritative.
 
-The repository version is stored in `VERSION`. The current release candidate
-is `v1.0.0-rc.1`.
+The repository version is stored in `VERSION`. The current release is
+`v1.0.0`.
 
 ## Mandatory preconditions
 
@@ -65,7 +65,7 @@ large storage:
 bash scripts/backup_release_state.sh \
   --container geointel \
   --output-root /mnt/user/appdata/geointel/backups \
-  --release-id v1.0.0-rc.1 \
+  --release-id v1.0.0 \
   --storage-path /mnt/user/appdata/geointel/storage \
   --models-path /mnt/user/appdata/geointel/models \
   --inventory-mode sha256
@@ -75,14 +75,14 @@ Verify and restore only into an automatically generated temporary database:
 
 ```bash
 bash scripts/verify_release_backup.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel
 bash scripts/restore_release_backup_smoke.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel \
   --confirm-isolated-restore
 bash scripts/verify_release_upgrade_smoke.sh \
-  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
+  --backup-dir /mnt/user/appdata/geointel/backups/v1.0.0 \
   --container geointel \
   --confirm-isolated-upgrade
 ```
@@ -96,11 +96,11 @@ their generated verification database.
 bash scripts/verify_release_fresh_install.sh \
   geointel-all-in-one:<release-commit>-ai
 bash scripts/run_rc8_release_journeys.sh \
-  http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc8
+  http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc8
 bash scripts/run_rc9_ux_audit.sh \
-  http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc9
+  http://127.0.0.1:1202 artifacts/releases/v1.0.0/rc9
 bash scripts/run_rc10_data_operations_audit.sh \
-  artifacts/releases/v1.0.0-rc.1/rc10
+  artifacts/releases/v1.0.0/rc10
 ```
 
 The RC10 command is read-only and runs cleanup in dry-run mode only.
@@ -113,10 +113,10 @@ cd frontend && npm audit --audit-level=high
 cd ..
 bash scripts/generate_container_sbom.sh \
   geointel-all-in-one:<release-commit>-ai \
-  artifacts/releases/v1.0.0-rc.1/geointel-sbom.spdx.json
+  artifacts/releases/v1.0.0/geointel-sbom.spdx.json
 bash scripts/scan_container_image.sh \
   geointel-all-in-one:<release-commit>-ai \
-  artifacts/releases/v1.0.0-rc.1/container-vulnerabilities.json
+  artifacts/releases/v1.0.0/container-vulnerabilities.json
 ```
 
 The complete vulnerability report remains evidence. The executable policy
@@ -144,8 +144,8 @@ release key; never add the private key to the repository:
 ```bash
 git -c gpg.format=ssh \
   -c user.signingkey=/secure/path/release-key \
-  tag -s v1.0.0-rc.1 -m "GeoIntel v1.0.0-rc.1"
-git push origin v1.0.0-rc.1
+  tag -s v1.0.0 -m "GeoIntel v1.0.0"
+git push origin v1.0.0
 ```
 
 Place the collected evidence files in an ignored package directory and create
@@ -153,14 +153,14 @@ the detached SSH signature plus complete checksum inventory:
 
 ```bash
 python scripts/build_release_package.py build \
-  --output-dir artifacts/releases/v1.0.0-rc.1 \
-  --release-id v1.0.0-rc.1 \
+  --output-dir artifacts/releases/v1.0.0 \
+  --release-id v1.0.0 \
   --image-name geointel-all-in-one:<release-commit>-ai \
   --image-id sha256:<image-id> \
   --image-revision <release-commit> \
   --signing-key /secure/path/release-key
 python scripts/build_release_package.py verify \
-  --package-dir artifacts/releases/v1.0.0-rc.1
+  --package-dir artifacts/releases/v1.0.0
 ```
 
 The builder refuses a dirty worktree, a tag not pointing at `HEAD`, a mismatched