release: cut 1.0.0

Pin compose and local trial to ghcr.io/mixeme/selfpost:1.0.0, close the
CHANGELOG cut, and retire implementation-plan / v1.x-closure-plan.

Includes the post-cut startup fixes needed for a green release e2e gate:
root-owned TLS copies for postfix check, maillog_file_prefixes for /data,
hostname gate and traversable /data, panel /healthz before setup, and
setup-token / TempDir reclaim via docker exec.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/process_check.go

@@ -45,7 +45,10 @@ func checkSupervisorProcesses(s *stack) error {
 		}
 		return true, nil
 	})
-	return err
+	if err != nil {
+		return fmt.Errorf("%w\n==== selfpost logs ====\n%s", err, s.logs("selfpost"))
+	}
+	return nil
 }
 
 func parseSupervisorStatus(out string) map[string]string {