release: AHP 1.0.0

[Connor Peet (connor4312)]

Summary

Supersedes #495 because branch protection prevents replacing that PR's original release commits. This PR preserves a two-commit release/development history with the updated release SHA.

• Prepare AHP 1.0.0 for the spec and all six clients: Rust, Kotlin, TypeScript, Swift, Go, and .NET.
• Consume all 27 changelog fragments into seven release entries dated 2026-10-02, folding the unreleased 0.10.0 spec entry into 1.0.0.
• Update all native client versions, Rust workspace dependency pins, lockfiles, generated version constants, and release metadata.
• Remove the pre-existing handwritten .NET Unreleased notes as requested; retain the fragment-derived 1.0.0 entry and all previous release entries.
• Advertise only 1.0.0 and 0.9.0 as released protocol compatibility baselines across all clients.
• Add host-side negotiation helpers in all six SDKs that select the highest client-offered SemVer in ^1.0.0 or ^0.9.0, regardless of offer order. Malformed versions produce explicit errors; no match requires UnsupportedProtocolVersion and connection closure. SDK validation of host-selected versions remains unchanged.
• In a separate second commit, advance the development protocol version to 1.1.0 without changing the advertised compatibility baselines.

Merge strategy

Merge this PR with a merge commit, not squash. Release tags must point to the first commit, where the protocol and all native package versions are 1.0.0. The second commit speaks development protocol 1.1.0 and must not be tagged for this release.

Validation

• npm run generate and npm test passed for both release and post-release states: 516 tests, with 100% reducer branch coverage.
• TypeScript client npm run build and npm test passed: 77 tests.
• All six SDKs pass the same 22-case negotiation corpus, including caret-range boundaries, numeric ordering, duplicate and reordered offers, unsupported versions, and malformed input.
• Rust negotiation and wire round-trip tests plus Clippy, Go client and wire-type suites, Swift negotiation and wire round-trip tests, and Kotlin negotiation tests passed.
• .NET passed 602 regression tests, the separate real-WebSocket TypeScript-host conformance test, and a netstandard2.0 abstractions build without warnings.
• npm run verify:changelog passed after the .NET notes cleanup.
• Verified all seven release entries and client metadata at the release SHA, every consumed fragment message in each targeted release entry, and separation of release/development protocol versions.
• Per-language builds and conformance tests are covered by PR CI.

After merge: publish 1.0.0

All seven tags must use this exact release commit:

(
set -e
RELEASE_SHA=5f16d81bb7045b66d7bc768d244feab75002d943
git fetch origin main
git merge-base --is-ancestor "$RELEASE_SHA" origin/main

git tag spec/v1.0.0 "$RELEASE_SHA"
git tag rust/v1.0.0 "$RELEASE_SHA"
git tag kotlin/v1.0.0 "$RELEASE_SHA"
git tag typescript/v1.0.0 "$RELEASE_SHA"
git tag v1.0.0 "$RELEASE_SHA"
git tag clients/go/v1.0.0 "$RELEASE_SHA"
git tag dotnet/v1.0.0 "$RELEASE_SHA"

git push origin spec/v1.0.0
git push origin rust/v1.0.0
git push origin kotlin/v1.0.0
git push origin typescript/v1.0.0
git push origin v1.0.0
git push origin clients/go/v1.0.0
git push origin dotnet/v1.0.0
)

Stop if the ancestry check fails. Push tags individually so each publication trigger receives its own push event.

Spec, Rust, Swift, and Go publication runs appear in GitHub Actions. Kotlin, TypeScript, and .NET publish through Azure DevOps, not GitHub Actions; verify their runs in the AHP pipelines in vscode-engineering. .NET publication requires approval.