release: v1.0.1 — Marketplace container-path fixes (#281)

[fheikens]

Summary

Prepares the v1.0.1 patch release carrying the already-merged Marketplace
container-path fixes, so the broken :1.0.0 container path is superseded by a
signed, published :1.0.1.

Version bump only — no functional code changes (the fixes landed in #277).

Included fixes (already on main)

• Bump Go toolchain to 1.26.5 — govulncheck gate fails on stdlib GO-2026-5856 #253 Go toolchain 1.26.5 (govulncheck stdlib GO-2026-5856)
• Marketplace: clean Helm install stalls because the PVC has no storage class #273 EBS CSI + gp3 storage prerequisite (install docs)
• Helm: implement the documented extraEnv path needed for TLS and controlled overrides #274 schema-validated extraEnv chart path
• Marketplace Helm: non-root container cannot write to a fresh EBS-backed /data volume #275 fsGroup: 10001 / OnRootMismatch non-root EBS write
• Marketplace docs: verification commands target the wrong Helm Deployment name #276 Marketplace verification Deployment name

Changes

• Chart.yaml version/appVersion and values.yaml image.tag: 1.0.0 -> 1.0.1 (lockstep policy).
• CHANGELOG.md: dated [1.0.1] section + fresh empty [Unreleased].
• Cloud deploy-example image pins (AWS/Azure/GCP terraform/CFN/bicep, EC2 Image Builder, RDS IAM live-smoke default): :1.0.0 -> :1.0.1 so examples stop shipping the broken container.

Out of scope (deliberate)

• docs/marketplace/* stays at 1.0.0 until the separate, human-gated Marketplace ECR re-host + exact-digest re-test. That step is what closes Marketplace: clean Helm install stalls because the PVC has no storage class #273/Helm: implement the documented extraEnv path needed for TLS and controlled overrides #274/Marketplace Helm: non-root container cannot write to a fresh EBS-backed /data volume #275; this PR does not close them.

Release sequence (human gates after merge)

1. Merge this PR (Chart.yaml version now matches the intended tag).
2. Verify main HEAD carries the bump, then cut the v1.0.1 GA tag (your call).
3. Publish workflow builds + cosign-signs image + chart on ghcr.
4. Re-host :1.0.1 image + chart into the Marketplace ECR; re-run the ingestion scan.
5. Exact-digest re-test on EKS, then close Marketplace: clean Helm install stalls because the PVC has no storage class #273/Helm: implement the documented extraEnv path needed for TLS and controlled overrides #274/Marketplace Helm: non-root container cannot write to a fresh EBS-backed /data volume #275.

Testing

• helm lint clean; helm template renders ghcr.io/elevarq/signals:1.0.1.
• actionlint clean on the edited workflow.
• scripts/check-docs.sh passes (guarded docs keep the :<version> placeholder).
• No Go changed.

Closes #281