Rewrite the changelog and readme.txt for the 1.0.0 release (#6)

[sean-e-dietrich]

Fixes #6

Merge order: after #10, #11 and #12

The [1.0.0] entry describes the plugin as it will ship, and that includes what the three open PRs add:

• Exception mode: answer block, redirect and challenge on the wp-config.php path #10: exception mode answered in the wp-config.php bootstrap, and the Site Health evaluation check going critical when it can't be.
• Uninstall: remove what the plugin wrote outside the default private directory #11: uninstall removing what the plugin wrote outside the default private directory, with the ownership guard.
• Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12: the release zip smoke-tested in CI and published to GitHub Releases on a tag. Its build/release-notes.sh cuts the notes from this section.

If this merges first, main has a changelog describing features it doesn't have yet. A trial merge of #10, #11, #12 and this branch onto main has no conflicts. My README edits are two single lines, away from the hunks those PRs touch.

CHANGELOG.md

• A single ## [1.0.0] entry covering what the plugin is at release: rule types, responses, evaluation paths, screens, storage and cache backends, logging, challenges, presets, incident tools, WP-CLI, Site Health, hooks, export/import, capabilities, uninstall, schema upgrades and the release zip. Built on kanopi/firewall ^2.33, bundling 2.33.0. The Security section from the old entry is kept and brought up to date.
• An empty ## [Unreleased] above it. The Keep a Changelog intro is unchanged.
• The Fixed entries are gone, because they fixed code that was never released. This also removes the repeated bullets Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12 flagged at the end of the file. What a pre-release install still needs is in Upgrading from a pre-release build:
  • the automatic schema rewrites: private://, regex bodies, geo/ASN variable names, record_request
  • what is translated at compile time instead: the old operator names and the geo reader keys
  • two things to check by hand: the UA detection cache, and geo/ASN readers
  • refreshing the mu-plugin loader
  • the uninstall ownership marker

Counts checked against the code:

Claim	Source	Count
Rule types	src/RuleType/Registry.php	10
Admin screens	src/Admin/Admin.php	15: 14 in the menu, plus the rule editor
WP-CLI subcommands	src/Cli/Commands.php	15
Site Health tests	Site_Health::test_map()	17

None of #10–#12 changes these counts.

Release date

There is no date yet. The heading is plain ## [1.0.0], which both of #12's scripts accept. They strip an optional trailing - YYYY-MM-DD. Add the date when tagging (## [1.0.0] - YYYY-MM-DD), as the issue's last task says. Neither script needed changing.

readme.txt

• = 1.0.0 = summary in place of = Unreleased =, and the stale one-line = 1.0.0 = is gone.
• Tested up to: 7.1, up from 6.9. CI's integration-wplatest-php8.3 job installs WordPress 7.1.2 and passes (CircleCI job 120, on Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12). The local DDEV site runs 6.9.7, and the nightly jobs run trunk. 7.1 is the newest major.minor the suite has actually passed on.
• Requires at least: 6.4 and Requires PHP: 8.1 match the plugin header, composer.json and the CI floor job. Stable tag: 1.0.0 matches the header and BASIC_FIREWALL_VERSION.
• Corrected "database storage cannot be used on the wp-config.php path". Since Early-path storage, referenced lists, and the first green CI run #1 it works when the snippet sits below the DB_ constants, as the README already says.
• Installation now points to GitHub Releases, says Firewall → Status (the menu label, not "Dashboard"), and gives the vcs Composer route, since the package is not on Packagist.

README.md

• "The Dashboard prints the snippet" becomes "The Status screen", in two places.
• Other count and version claims were checked and are correct, or are handled elsewhere:
  • 10 rule types, 15 CLI commands, and the 2.24.0 benchmark provenance are all correct.
  • "Eleven jobs" is correct on main. Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12 updates it.

Verification

• bash build/check-versions.sh passes, as do --release and v1.0.0 (Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12's script, run against this branch's files).

• bash build/release-notes.sh 1.0.0 exits 0. Its output is byte-identical to the section body.

• The same checks pass on the trial merge of Exception mode: answer block, redirect and challenge on the wp-config.php path #10, Uninstall: remove what the plugin wrote outside the default private directory #11, Release pipeline: exercise the zip, check versions, publish on a tag (#7) #12 and this branch.

• No PHP changed, so composer lint does not apply.

• Was AI used in this pull request?