release: prepare v1.0.0-alpha.1

[andy-library]

Summary

• align framework, consumer contracts, and Demo artifacts on 1.0.0-alpha.1
• add bilingual release notes and update the changelog and release guide
• upgrade Bouncy Castle to 1.84, MinIO to 8.6.0, and Commons Lang to 3.18.0
• remove intentionally vulnerable dependency coordinates from the negative contract fixture
• align runtime-visible Drools rule metadata with the release version

Verification

• Parent/BOM reactor: 4 modules passed
• Starter reactor: 19 modules passed
• Parent consumer contracts: 9/9 passed, including expected negative failures
• Demo: 116 tests, 0 failures, 0 errors, 28 real-middleware tests skipped by the default profile
• Drools Starter: 29 tests passed
• Observability Starter: 67 tests passed
• git diff --check passed and no tracked 1.0.0-SNAPSHOT references remain

Known upstream advisory

XXL-JOB 2.4.2 has a low-severity SSRF advisory with no patched upstream release. The release documentation requires restricting executor callback targets and network access.