Release 1.0.0

Declare the snapshot format (v1) stable, bump the version, ship the man
page in release archives and deb/rpm/apk/Arch packages, add a Homebrew
formula template with make brew-formula, and update the changelog,
roadmap, README and development notes.

CHANGELOG.md

@@ -1,11 +1,18 @@
 # Changelog
 
-## Unreleased
+## 1.0.0 — 2026-10-02
+
+First stable release. The snapshot format (version 1) is now stable: later
+1.x releases will keep reading version 1 snapshots.
+
+### Engine
 - Bounded concurrent scanner with incremental aggregation, cancellation,
   hard-link and symlink-loop handling, error accounting.
 - Non-interactive reports: `--top`, `--largest-files`, `--json`, `--csv`,
   `--duplicates`, `--no-ui`.
 - Versioned, checksummed snapshot format; `--compare`.
+
+### Interface
 - Interactive TUI (Bubble Tea v2): live squarified treemap with nested
   previews and level-of-detail grouping, spatial arrow navigation, zoom,
   breadcrumbs, responsive layouts, info/help/confirm/save modals, mouse.
@@ -16,3 +23,22 @@
   perceptual 256-colour quantizer, NO_COLOR support.
 - Move to trash (freedesktop / macOS / Windows), `--read-only`.
 - `treegen` synthetic tree generator; benchmarks in PERFORMANCE.md.
+
+### Packaging and documentation
+- `mapsize(1)` manual page; `make install` installs binary and man page.
+- `make release`: archives for Linux, macOS, Windows and the BSDs, plus
+  .deb, .rpm, .apk and Arch packages (with the man page) and SHA256SUMS.
+- Version stamped into release builds.
+- Homebrew formula template and `make brew-formula`.
+
+### Hardening
+- Snapshot loader rejects over-deep trees, decompression bombs and
+  out-of-range sizes; aggregates saturate instead of overflowing.
+- Exclusion patterns from snapshot metadata are sanitised in reports.
+- Duplicate, trash and filter results belonging to a replaced tree (after
+  a rescan) are discarded.
+- Linux trash refuses symlinked or foreign trash directories on shared
+  filesystems and never overwrites an earlier trashed item.
+- Symlinks are not followed on platforms without inode identity; the
+  unscanned-directory count and post-cancel errors are reported correctly.
+- Path filters evaluate incrementally (2× faster on 1M entries).