Prepare codex-notify 1.0.0 release

[koichiro]

Summary

• prepare codex-notify 1.0.0 as the first stable RubyGems.org release
• add a packaged CHANGELOG covering the stable feature set, security posture, compatibility, and migration guidance
• complete RubyGems metadata, including versioned source/changelog links and the MFA requirement
• update installation, upgrade, uninstall, version discovery, packaging, and trusted-release documentation
• add reviewed versioned release notes and compose them with the published gem SHA-256 in the release workflow

Security and compatibility

Repository .env files remain restricted by default, while the explicitly trusted legacy policy remains documented as a temporary migration path for removal in a future major release. Existing supported Hook aliases and legacy payload shapes remain compatible.

RubyGems publication continues to use the protected release environment and OIDC Trusted Publishing without a long-lived RubyGems API key. The gem package allowlist adds only CHANGELOG.md; release notes and workflow files remain outside the gem.

The public gem contact remains the existing maintainer email.

Validation

• Ruby 4.0.6: bundle exec rake — 261 runs, 1,371 assertions, 94.84% line coverage
• Ruby 4.0.6: bundle exec rake package:contents
• Ruby 4.0.6: bundle exec rake package:verify — isolated install passed
• Ruby 3.4.9: RBENV_VERSION=3.4.9 bundle exec rake — 261 runs, 1,371 assertions, 94.84% line coverage
• Ruby 3.4.9: RBENV_VERSION=3.4.9 bundle exec rake package:verify — isolated install passed
• git diff --check

Closes #83