Audit and enforce the v1.0.0 build and CI release gates

[acgetchell]

Current v1.0.0 plan (2026-07-24)

Starts after: #108 and #114. Blocks: #96.

Treat the current repository as the baseline and perform a final enforcement audit. Do not repeat modernization already completed on main.

Native GitHub dependency metadata is the source of truth for ordering.

---

Summary

Audit and enforce the clean-checkout build, test, and CI contract that will gate the v1.0.0 release.

This issue closes gaps between documented commands, local recipes, GitHub Actions, dependency pins, and branch protection. It is not another build-system redesign or dependency-modernization campaign.

Scope

• Verify the documented clean-checkout configure, build, and test commands.
• Confirm that CMake requirements, presets, vcpkg configuration, scripts, and just recipes describe the same supported contract.
• Confirm the supported Linux, macOS, and Windows C++23 compiler/platform matrix.
• Ensure every required unit, integration, sanitizer, documentation, coverage, and static-analysis gate actually fails CI when its underlying check fails.
• Confirm retained dependency baselines, tool pins, and GitHub Action pins are intentional and reproducible.
• Remove only demonstrably obsolete or non-enforcing workflow/script paths that conflict with the final contract.
• Keep fast local checks, full CI, sanitizer, coverage, documentation, and release gates distinct and understandable.
• Verify CI logs and retained artifacts are sufficient to diagnose release-blocking failures.
• Align branch-protection required checks with the final stable job names.
• Record final clean-checkout CI evidence for Prepare v1.0.0 documentation, metadata, and archival handoff #96 and Approve CDT++ v1.0.0 release readiness #90.

Non-goals

• No broad dependency update unless required to make a supported release gate correct.
• No package-manager migration.
• No CMake target-graph or install/package redesign.
• No new platform, compiler, sanitizer, or analysis service solely for modernization.
• No repetition of cleanup already completed and enforced by existing checks.

Acceptance criteria

• One documented clean-checkout command path configures, builds, and tests the supported reference configuration.
• The documented opt-in parallel and viewer paths have focused, reproducible gates without weakening the headless default.
• The declared Linux, macOS, and Windows C++23 matrix passes.
• All required tests and validators are release-blocking.
• No workflow advertises a disabled, ignored, redundant, or permanently failing check.
• CMake, vcpkg, tool, dependency, and Action pins have one clear source of truth and an intentional update path.
• Branch protection requires the intended final checks by stable name.
• Final CI evidence is linked from the release-readiness path.