Verify the 1.0 release-candidate first-run experience end to end

## Context

A stable release is only useful if a new adopter can complete its first journey using the published documentation and release artifacts. Source-built binaries, private maintainer knowledge, and a development checkout can hide packaging and documentation defects.

Historical v0.8.4 and v0.9.0 findings remain useful issue history, but this ticket now gates the final Registry Stack 1.0 release candidate.

## Scope

Use the final 1.0 release-candidate documentation and downloaded release-candidate assets on a clean machine or container.

- Complete the quickstart and credential tour.
- Publish a spreadsheet as a secured registry API.
- Verify a consultation-backed claim against a Registry project.
- Initialize, test, check, and build at least one country integration through the documented Registry project workflow.
- Use the downloaded `registryctl` binary and matching published image-lock or digest evidence.
- Confirm every release binary self-reports the exact candidate version.
- Confirm generated projects use the published Relay and Notary image and artifact digests.

Do not use a development binary from `PATH`, locally built images, unpublished files, or undocumented maintainer steps.

## Acceptance criteria

- A fresh reader completes every documented step as written and sees the documented results.
- The credential tour completes through wallet receipt and verification.
- The Registry project journey does not require hand-editing generated Relay or Notary configuration.
- Every release binary reports the exact candidate version and every referenced artifact is publicly retrievable and verifiable.
- Every deviation is fixed or filed as an explicit 1.0 blocker and linked here.
- No active reader route depends on the deprecated hosted Registry Lab. The equivalent credential journey passes using a tagged Registry Stack release and standalone Solmara atomically pinned to its registryctl, Relay, Notary, and image digests. Where Notary applies, the journey proves one Notary and one Notary-owned PostgreSQL database per Relay authority, including restart persistence.

## Security note

Use only public synthetic identities and non-sensitive fixtures. Route any suspected vulnerability through `SECURITY.md`, not this issue.

Start with the final 1.0 release-candidate documentation, downloaded release assets, the registryctl binary, and SECURITY.md. Run the quickstart, credential tour, and Registry project workflow on a clean machine or container using only published artifacts. Done means every documented journey and version or digest check passes, with deviations fixed or recorded as linked 1.0 blockers.

Written by the indexing model from the issue text.