release: 1.0-rc — freeze public API, semver discipline

## Problem
We went from \`0.1.8\` to \`0.1.15\` in a single working session. Each one was a correct release-please cut, but the cadence reads as \"still moving fast\" to external consumers, and there is no public statement of which surfaces are **stable** vs. **likely to break** in the next minor.

Before any zig-libp2p announcement to the broader Zig / libp2p audience we need a 1.0-RC that:

1. Freezes the \`root.zig\` public re-exports as the stable surface.
2. Locks the QUIC + libp2p TLS wire (covered by tests + the cross-impl matrix, but make the *commitment* explicit).
3. Documents what's deliberately **not** stable (Noise XX SSP, async swarm, anything still under #57 or #169).
4. Adopts a written semver-breakage rule (\"breaking changes only with a major\") going forward.

## Scope
- \`docs/STABILITY.md\` listing every \`pub const\` in \`root.zig\` with a stability tier (stable / preview / internal).
- \`README.md\` Status block updated to reference the stability doc.
- Tag \`v1.0.0-rc.1\` once the spec gaps tracked in #91 #92 #93 #94 #169 #170 #171 are either implemented or **explicitly documented as out of scope for 1.0**.

## Out of scope
Actual ecosystem-feature parity with go-libp2p (DHT, relay, NAT). 1.0 here means \"the lean-consensus / Eth2 subset is stable\", not \"feature parity with the largest libp2p in the ecosystem\".

## Acceptance
- \`docs/STABILITY.md\` merged.
- \`v1.0.0-rc.1\` published via release-please.
- README announces the freeze; CHANGELOG documents the semver rule.

Start by reviewing root.zig and the existing README.md, CHANGELOG, and protocol tests or cross-implementation matrix mentioned in the issue. Check #91, #92, #93, #94, #169, #170, and #171 before defining the stability tiers. Done means docs/STABILITY.md is merged, the README and CHANGELOG state the freeze and semver rule, and v1.0.0-rc.1 is published through release-please.

Written by the indexing model from the issue text.