release: assemble and approve the crypto SDK 0.1.0-rc.1 milestone

## Outcome

Produce the engineer-review and human-approval packet for the first isolated
SDK-Rust release candidate:

| Crate | Purpose in the release train |
| --- | --- |
| `identus-derive` | Compile-time validated-newtype generation and common safe derive behavior; it contains no runtime SSI, chain, custody, or protocol policy. |
| `identus-core` | Chain-neutral foundational types and ports shared by higher SDK components; it depends on `identus-derive` but owns no cryptographic implementation. |
| `identus-crypto` | Reusable bytes-in/bytes-out cryptographic primitives, key representations, hashing, derivation, and explicit entropy injection; it owns no wallet custody, ledger, DID-method, or product policy. |

The intended candidate is `0.1.0-rc.1` for all three packages with exact
internal requirements. This issue coordinates evidence and engineer approval;
it does **not** authorize a tag, GitHub release, crates.io upload, `main`
promotion, or final `0.1.0`.

## Approval gates

- [x] Public architecture/documentation site is deployed from exact protected
`develop` revision `4a39d7dbde1caf50c26545a2eda609500aa2a146` and
[open for engineer review](https://github.com/hyperledger-identus/sdk-rust/discussions/328).
- [x] The documentation deployment uses supported action runtimes without the
observed Node.js 20 deprecation warning (#329).
- [ ] Crates.io ownership and the first-publish bootstrap are resolved under
#3 for the three selected durable names; trusted publishing is configured
immediately after that one manual bootstrap.
- [x] The release compiler/support matrix is accepted and proven under #325.
- [ ] One externally owned, source-pinned adoption canary proves a real
consumer and records the exact minimal feature/dependency cone. The
consumer owns all adapters and product/chain semantics; only a generic
immutable receipt is reported back to this milestone.
- [ ] #276 records a healthy natural weekly run, and the unchanged release
candidate has a green complete slow receipt.
- [ ] Candidate archives are byte-reproducible and pass package closure,
public-API, SemVer, conformance, feature/target, security/advisory,
license, unsafe-code, SBOM, checksum, and provenance gates.
- [ ] Changelog, migration notes, experimental support window, limitations,
rollback/yank procedure, and crate-owner responsibilities are reviewed.
- [ ] One assigned release manager and a second maintainer approve the exact
candidate receipt.

## Repository boundary

SDK-Rust remains generic and chain-neutral. This milestone does not add a
consumer repository, chain primitive, DID method, ledger/runtime dependency,
domain tag, or product policy to any SDK crate. Downstream canaries are
implemented and reviewed in their owning repositories.

## Engineer review questions

1. Are the three crate responsibilities cohesive and appropriately separated?
2. Is the public API small and explicit enough for an experimental SemVer
commitment?
3. Does the compiler/target promise match real consumer needs and maintenance
capacity?
4. Does the dependency and unsafe/native cone meet the SDK threat model?
5. Is the documentation sufficient for a consumer to adopt or reject the
candidate without tribal knowledge?
6. Is any blocker missing from the evidence table?

## Evidence already available

- [Public SDK-Rust handbook](https://hyperledger-identus.github.io/sdk-rust/),
deployed by [run 35219058383](https://github.com/hyperledger-identus/sdk-rust/actions/runs/35219058383)
from protected `develop` revision `4a39d7dbde1caf50c26545a2eda609500aa2a146`.
- [M3 engineer approval discussion](https://github.com/hyperledger-identus/sdk-rust/discussions/328).
- #266 and ADR 0113: deterministic unpublished three-package candidate.
- #286: cryptographic foundation completion evidence.
- #320/#322: measured autonomous factory delivery and guarded merge receipts.
- NeoPRISM PR #324: source-pinned SDK-Rust consumer evidence, intentionally
still open while the SDK is pre-release.
- `RELEASING.md`: protected two-person release process.

## Tracked work

- #324 — public SDK-Rust architecture and release handbook (complete).
- #329 — upgrade the official Pages artifact action and clear its runtime
deprecation warning (complete).
- #325 — select and prove the compiler/support matrix (complete).
- #3 — secure the three durable crate names and bootstrap trusted publishing.
- #276 — observe the first healthy natural weekly slow run.
- External consumer adoption — downstream-owned; green reviewed draft
MediaNoxLabs/midnight-identity#84 records the generic immutable adoption
receipt and awaits human merge.

## Stop condition

After every checklist item is evidenced, stop for explicit human release
authority. Approval must bind the exact candidate revision and receipt; a
general approval of this issue is not permission to publish a later SHA.

Start with RELEASING.md, the checklist in this issue, and the linked evidence for #3, #276, #325, and the external adoption canary. Review the exact candidate revision and receipt against every approval gate. Done means all gates are evidenced, the release manager and second maintainer approve the exact candidate, and no publication or promotion occurs without explicit authority.

Written by the indexing model from the issue text.