[freeze] STABILITY.md: write the 1.0 promise (semver surface, crate tiers, on-disk format, MSRV, deprecation)

[joeldsouzax]

Problem

The freeze milestone lands API decisions, but nowhere is it written down what the freeze promises to a consumer. Bombay is about to become the first serious dependent (M2 adapter); external adopters follow via the B1 OSS funnel. Without a written policy, every future change negotiates "is this breaking?" from scratch, and adopters can't judge what pinning 1.x buys them.

Write STABILITY.md (or a rustdoc stability module) covering

• Semver surface: what is public API (kernel + nexus-store traits/types), what is explicitly NOT (anything #[doc(hidden)], the sealed driver seam from [freeze][T1] Seal the AggregateRoot repository-driver seam (replace #[doc(hidden)] pub) #212, adapter internals, nexus-store-testing assertions)
• Crate tiers: kernel/nexus-store at 1.0 vs adapters at 0.x — what a major bump in one implies for the others
• On-disk format promise: the frame-format-version byte ([freeze][T0] Add a frame-format-version byte to the wire layout (irreversible on-disk) #205) semantics — which releases can read which format versions, forward/backward guarantees, and the export/import (CBOR box) compatibility story across majors
• MSRV policy: currently pinned 1.95; is an MSRV bump minor or major? (Recommend: minor, with N-2 stable floor, stated explicitly)
• Feature-flag guarantees: which features are additive-forever (the [freeze][T1] Make the json feature additive (repository() signature differs by cfg) #211 json fix makes this claimable), which are unstable/perma-0.x
• Error-enum policy: the [freeze][T1] Apply #[non_exhaustive] to public ERROR enums at freeze (conscious override of the ban) #209 conscious #[non_exhaustive] override — document the rule so future error variants don't relitigate it
• Deprecation policy: minimum deprecation window before removal (e.g. one minor release + a cycle)

Why pre-freeze

The act of writing it is an audit: every clause you can't write cleanly ("wait, IS the json feature additive yet?") points at an unfinished freeze card. Cheap to do now, impossible to retrofit honestly after adopters exist.

Acceptance

STABILITY.md merged, linked from README + CLAUDE.md; every open freeze card either conforms to it or has a comment saying which clause it changes.

From the 2026-07-05 cross-repo roadmap review (ROADMAP.md Phase 0).