Normalize StoreKit2 master-only releases

[Kapusch]

Summary

• make master the sole long-lived development and release branch
• require RC and stable tag sources, manual version sources, and explicit historical source_ref values to be reachable from origin/master
• reject existing NuGet.org versions and preserve existing tag targets
• record source SHA and package SHA-256 provenance for every publish run
• add deterministic release documentation, repository/AI guidance, a real iOS sample, and a shared NuGet layout validator
• run CI on pull requests and post-merge pushes to master
• align the repository with the .NET 10.0.202 feature band and iOS workload set required by Xcode 26.3

History audit

After git fetch --prune origin, both origin/master and origin/release/1.0.0 point to f453c9d. Their merge-base is that same commit and git rev-list --left-right --count origin/master...origin/release/1.0.0 reports 0 0. Local recovery refs were retained before creating this feature branch. The existing annotated tag v1.0.0-rc.1 remains unchanged and targets commit 27cc3da, which is reachable from origin/master.

Validation

• native Swift wrapper built for iOS arm64, simulator arm64, and simulator x86_64; xcframework creation passed
• package project build passed with 0 warnings / 0 errors
• iOS sample build passed
• NuGet pack passed
• scripts/validate-nupkg.py passed for Kapusch.StoreKit2.iOS.0.1.0.nupkg (SHA-256 93aabda672dc2e9861d2624d75d9be0fb943ceb40eab06388464e2d9eb2cedff)
• all three GitHub Actions workflow YAML files parsed successfully
• sample Info.plist validation and git diff --check passed
• official NuGet index currently contains only 1.0.0-rc.1

Remote release/1.0.0 deletion remains intentionally gated on this PR being merged, post-merge master CI passing, a fresh fetch proving no release-only commit, and a final tag/provenance inventory.