[Release] Harden and publish Flow's first immutable release

[szmyty]

Suite roadmap: #11
Depends on: #3, #34, #70, and #71; requires an explicit disposition for remaining observability work under #14

Outcome

Publish Flow's first immutable integration-candidate release from one reviewed, green commit so operators and the sibling projects can install and verify it without a repository worktree.

Scope and acceptance criteria

• Select a new SemVer candidate and reconcile Cargo/package versions, changelog, roadmap, README, docs, schemas, and generated capability metadata.
• Publish an immutable GitHub prerelease/release from the exact reviewed commit; never move or reuse a tag.
• Produce supported binaries/packages, SHA-256 checksums, SBOM, dependency/license notices, build provenance or attestation, and an explicit signing decision.
• Publish a machine-readable compatibility manifest covering Flow schemas/contracts and the exact Aniflow, Optiflow, and Renderflow releases/digests.
• Perform clean-install tests from downloaded artifacts for version/help/doctor, inspect/plan, the supported CLI vertical slice, failure behavior, and uninstall/rollback.
• Verify every advertised distribution channel and label unavailable channels honestly.
• Record known limitations, including any observability work intentionally deferred under [EPIC] Establish suite-wide observability and CLI experience #14.
• Preserve the release after publication; corrections require a new version.
• Main CI, schemas, docs, package checks, cross-platform tests, and integration evidence are green.
• Document compromised-release response and rollback.

Non-goals

• Declaring final stable v1 before the final provider audit and remediation.
• Adding unrelated provider capabilities.
• Claiming installation channels that were not actually published and tested.