Tighten the v1.1.0 release package boundary

[GsCommand]

Motivation

• Align Protocol-Commercial with the Protocol-Commons clean release model so a single current-line (v1.1.0) is the canonical shipped package surface and legacy v1.0.0 is retained only as historical repo material.
• Prevent accidental publication of unvalidated legacy artifacts by making the npm files/exports, checksum tooling, validation scripts, and docs describe the exact same shipped boundary.

Description

• Narrow the npm package surface in package.json to only the current-line artifacts and metadata: schemas/v1.1.0/, examples/v1.1.0/, manifest.json, checksums.txt, LICENSE, README.md, and added package-root index.js as the entrypoint and export; removed repo-wide wildcard schema/example exports.
• Add index.js that re-exports schemas/v1.1.0/index.json so the package root resolves to the current line via index.js.
• Change manifest legacy metadata to mark v1.0.0 as historical-repo-only (no longer treated as part of the shipped surface). (manifest.json).
• Tighten and align integrity and checksum tooling and validation scripts (scripts/generate-checksums.mjs, scripts/validate-integrity.mjs, scripts/validate-all.mjs) so they include LICENSE, README.md, and index.js among checksum targets and assert the package files/exports reflect the canonical published boundary.
• Update CI/workflow (.github/workflows/validate.yml) to run the aggregate npm run validate, regenerate checksums, and run npm pack --dry-run to verify the publish surface.
• Update repository docs to teach the same posture across README.md, POLICY.md, SPEC.md, SECURITY_PROVENANCE.md, ONBOARDING.md, and releases/v1.1.0.md, explicitly describing v1.0.0 as repository-only historical material.

Testing

• Ran npm install (succeeded).
• Ran npm run generate:checksums to regenerate checksums.txt (succeeded and wrote 45 entries).
• Verified checksums with sha256sum -c checksums.txt (succeeded).
• Ran the full validation aggregate via npm test (which runs npm run validate → validate:schemas, validate:examples, validate:integrity) and all validation checks passed (succeeded).
• Performed npm pack --dry-run to inspect the packed publish surface and confirmed the tarball contains only the narrowed v1.1.0 payload plus expected metadata (succeeded).

---

Codex Task