chore: bump to 1.0.0 for the first major release

[VincentGuyader]

Summary

Renames the unreleased 0.3.0 development line to 1.0.0 for the upcoming CRAN submission.

Changes

• DESCRIPTION — Version: 0.3.0 → 1.0.0.
• NEWS.md — section header # dockerfiler 0.3.0 → # dockerfiler 1.0.0, with a short lead paragraph explaining why a major-version bump (API maturity after this cycle's input-validation family, codegen hardening against renv.lock / DESCRIPTION injection, vendored-renv removal, multi-arch / PPM-binaries defaults). The three internal "since the 0.3.0 hardening" / "predates 0.3.0" pointers inside the Security bullets are updated to "1.0.0".
• cran-comments.md — section header ## Major changes since 0.2.6 → ## Major changes in 1.0.0 (with a one-line note that this is the first major release after the 0.2.x dev line); the three "0.3.0" mentions in the body retargeted to "1.0.0".
• README.md — re-knit (the live desc::desc_get_version() chunk picks up [1] '1.0.0').

No R code, no NAMESPACE, no Rd, no test impact (the "Version: 1.0.0" strings in tests/testthat/test-dock_from_desc.R are unrelated test-DESCRIPTION fixtures).

Test plan

• No remaining 0.3.0 occurrence anywhere in source (grep -rn 0\.3\.0 is empty).
• README.md shows [1] '1.0.0'.
• Targeted test file (test-r.R) still passes.
• CI green.

[VincentGuyader]

/copilot review

[VincentGuyader]

Force-pushed 1988581: folded in a tiny doc cleanup — R/utils.R had two @description blocks for the internal .github_pat_setup / .github_pat_run_prefix helpers that cross-referenced each other via [.github_pat_X()] markdown links. Both helpers are @noRd so no .Rd is generated, and roxygen emitted "Could not resolve link to topic" warnings on every devtools::document() (pre-existing since #109; not a R CMD check failure, just noise). Switched the references to plain backticks (.github_pat_X()). devtools::document() is now clean.