Fix release workflow LATEST_TAG fallback; pin v1.0.0

[5uck1ess]

What broke

PR #1's release workflow run produced `version=..1` and pushed a corrupt `manifest.json` to main (commit 7bc29d0).

Root cause: in `.github/workflows/release.yml`:

```bash
LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' || echo "0.0.0")
```

When no tags exist, `git describe` fails and writes nothing. `sed` then runs on empty input and exits 0. The pipe's exit code is sed's (success), so the `||` never fires. `LATEST_TAG` ends up empty.

Cascade: empty `LATEST_TAG` → integer comparisons error → manual-bump branch falls through to auto-bump → `cut` on empty produces empty MAJOR/MINOR → `NEW_VERSION="..${PATCH+1}"` = `..1`.

Fix

```bash
LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
LATEST_TAG=${LATEST_TAG#v}
```

Now `||` triggers on `git describe`'s actual failure. v-prefix stripped separately.

Also

• `manifest.json` re-pinned to `1.0.0` (washes out the `..1` corruption from main).
• `CHANGELOG.md` section header renamed `0.0.1` → `1.0.0` so the release-notes regex finds content for v1.0.0.
• New CHANGELOG entry documents the bug.

Test plan

• CI smoke passes
• On merge, version job picks up `manifest=1.0.0 latest_tag=0.0.0` → manual bump path → emits `version=1.0.0`
• No bump commit pushed (manifest already at 1.0.0)
• `create-release` tags `v1.0.0` on the merge commit, builds tarball, publishes