feat(xerrors)!: promote to v1.0.0 — add Unauthorized and PermissionDenied constructors

Add Unauthorized and PermissionDenied convenience constructors to complete the
set of the five most-used error codes (InvalidInput, NotFound, Internal,
Unauthorized, PermissionDenied). All roadmap items from v0.9.0 resolved.
API committed as stable.

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this module will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0] — 2026-05-08
+
+### Added
+
+- `Unauthorized(msg string, args ...any) *Err` — convenience constructor for
+  `ErrUnauthorized`; completes the set of the five most-used codes alongside
+  `InvalidInput`, `NotFound`, `Internal`, and `PermissionDenied`
+- `PermissionDenied(msg string, args ...any) *Err` — convenience constructor for
+  `ErrPermissionDenied`
+
+### Unchanged
+
+All existing API (`Code`, `Err`, `New`, `Wrap`, `InvalidInput`, `NotFound`,
+`Internal`, `WithContext`, `WithError`, `WithPlatformCode`, `ErrorCode`,
+`ErrorContext`, `MarshalJSON`) is API-compatible with v0.10.0.
+
+[1.0.0]: https://code.nochebuena.dev/go/xerrors/releases/tag/v1.0.0
+
 ## [0.10.0] - 2026-03-25
 
 ### Added