Propose what the version number promises

[tauanbinato]

Left open for review: a policy draft; it commits the project to promises only you can make.

What and why

Phase 5 of the roadmap: a 1.0 stability policy, as a site page (site/src/stability.md, under Background).

• Before 1.0: minor releases may change interfaces; patch releases only fix; pin a version in CI.
• From 1.0, semver covers: commands and flags, exit codes, jevgate.toml keys, levels and rule names, the JSON report (additive fields; schema_version for removals and meaning changes), jevgate-baseline.json and fingerprints (an upgrade must not make accepted findings new), and SARIF, GitLab and annotation output.
• Not covered: which findings rules report and their wording and probabilities (rule version bumps re-ask cached answers), the agent text, request bodies and the cache, and the default model.
• Deprecation: at least one minor release with a stderr warning before a major release removes a flag or key.
• Releases: batched minors, patches without waiting; binaries, crate, action, formula and site from the same tag.

Questions for review

• Is the fingerprint promise right? It rules out changes that re-fingerprint findings without carrying the baseline over.
• Should the MCP tools (Serve JevGate to coding agents over MCP #18) be covered once merged?
• What must be true to call it 1.0 (for example, the README and site in their final shape, inline suppressions decided)?