Initialize the RightUp site template recipe and start the 1.0.x branch

Merge request !6 is merged into 1.0.x as `cbb3b474`.

The recipe carried no theme-repointing actions, so config arriving from `varbase_blog_base` kept naming the base theme: `views.view.blog` bound its `all`, `latest` and `related` displays to `vartheme_bs5:*` components, and all 19 `canvas.content_template.node.blog.*` referenced 13 distinct `vartheme_bs5:*` components that do not exist on a RightUp site. Blog article pages returned HTTP 500 with `AssertionError: assert($component instanceof Component)` from Canvas `ComponentTreeItemList` line 479, and the Home and Blog pages printed a Twig `LoaderError` where the article grid belongs.

What landed:

- `setViewsComponentStyleTheme` on `views.view.blog`, plus the three per-display `component_id` values as dotted leaf paths so the options the base recipe set are not replaced.
- `repointComponentTreeToTheme` on each of the 19 blog content templates.
- An explicit `drupal/varbase_recipes` requirement, since it provides both config action plugins and was previously reaching a site only through the base project's lock file.

Verified at 1.0.x HEAD: 19 `repointComponentTreeToTheme`, 1 `setViewsComponentStyleTheme`, the three per-display component ids all `vartheme_bs5_rightup:`, and `drupal/varbase_recipes` declared.

Re-verified by installing from packages.drupal.org on both bases, each from a dropped database — Varbase 11 (`drush site:install varbase installer_site_template_form.add_ons=rightup`, exit 0) and Drupal CMS (`drush site:install drupal_cms_installer installer_site_template_form.add_ons=rightup`, exit 0). On both:

- default theme `vartheme_bs5_rightup`, 12 blog + 2 page nodes, 5 Canvas pages, 59 media
- zero config objects still naming `vartheme_bs5:`, and 0 of 19 blog content templates still referencing it
- `views.view.blog` displays now `vartheme_bs5_rightup:grid`, `:views-view-grid` and `:views-view-unformatted`
- all 5 Canvas pages return 200, and the Twig LoaderError is gone from Home and Blog
- 12 of 12 blog article pages return 200, previously 0 of 12
- zero error-severity watchdog rows

On the Drupal CMS base the `block.system_breadcrumb_block` component referenced by one blog content template now resolves, and there are no missing component ids across any content template, so that gap is closed as well.

Two notes for the record. The `drupal/varbase_recipes: 1.0.x-dev` pin is consistent with the other Varbase base recipes this file requires, and it is worth reading with #3620120: those dev pins are why a bare `composer require drupal/rightup:1.0.x-dev` fails against a codebase whose lock holds the released base recipes, so `-W` is currently needed on that path. Separately, a fresh Varbase build from packages.drupal.org currently aborts before the recipe is reached because `vardot/varbase-patches` 11.0.42 carries `drimage_improved--2026-04-28--3587334--mr-25.patch`, which no longer applies now that `drupal/drimage_improved` resolves to 1.0.12 — upstream in varbase-patches, unrelated to this recipe.

Remaining tasks updated for what this merge completes. Review, release notes and release stay open. The Version field was empty and is required on save, so it is set to 1.0.x-dev, the branch this landed on.

Released in rightup 1.0.0-alpha1.