[TristanKruse]

Problem and result

Following the cycle-evidence fix in #85, deep graphs could still overflow the JVM stack and the recommended properties/JUnit integration could not declare a cycle check. The v1 candidate now uses iterative SCC/enumeration, supports declarative type/package cycles, and records an explicit compatibility contract before API freeze.

The existing dependency configuration constructor and defaults are preserved. Cycle rules reject irrelevant dependency fields and retain empty-selection/incomplete-import failures. The 1.0 development line retains JDK 25 and the existing Maven coordinates; no package is published by this PR.

Scope

• Add three 10,000-node regressions (all failed with StackOverflowError before the iterative fix) and real-bytecode CLI checks through four result formats.
• Pin the Ruby/Python/TypeScript feature comparison and keep extra cohesion variants, metrics HTML and standalone build plugins out of the v1 release blockers.
• Add a public/protected signature baseline and CI gate; preserve the old CliRuleConfiguration constructor.
• Update current repository/Pages URLs for dragonsec-ai and prepare 1.0.0-SNAPSHOT without changing the beta install examples.

Verification

• Clean release-candidate verify: 378 tests, no failures/errors, two expected platform/opt-in skips; source/Javadoc artifacts pass doclint.
• Opt-in pinned performance/semantic snapshots pass with zero diagnostics.
• SpotBugs matches the reviewed 161-notice fingerprint exactly; no errors or missing classes.
• API gate matches 478 public/protected types and rejects a deliberately incompatible baseline.
• Basic consumer: one passing test; separate RAG consumer: five passing tests against 1.0.0-SNAPSHOT.
• Documentation site assembles; final reproducibility and GitHub CI evidence tracked in docs/V1_READINESS.md.

Fixes #86. Fixes #88. Fixes #89. Tracks #87, which remains open until final integrated release and publishing gates are satisfied.