[meta] Release 1.0.2 - first stable release

Problem/Motivation

The module has never had a stable release. The project page still states
"There are currently no supported stable releases." Everything shipped so far is
an alpha: 1.0.0-alpha1, 1.0.1-alpha1,
1.0.2-alpha1, 1.0.2-alpha2.

That is no longer an accurate reflection of the module's maturity. It is
running in production. The remaining blockers are a small, known set of bugs,
not missing functionality.

This meta issue tracks the cut line for 1.0.2. The scope is deliberately
tight: bugfixes only. No new features, no trace-shape changes,
and no move to the new major of the underlying PHP SDK. Anything that is not a
child of this issue does not go into 1.0.2.

Proposed resolution

Land the child issues below on the 1.0.x branch, then tag
1.0.2 without an alpha suffix.

The 1.0.x line stays pinned to dropsolid/langfuse-php-sdk:~1.2.0
and receives bugfixes only. Forward development moves to a separate
1.1.x branch pinned to SDK ~1.3.0 — see the [plan]
issue for that line.

Blockers

• #3594090 — Trace is stored in global state, possibly leaking traces
  across requests/users. Must land together with #3561460.
• #3561460 — Force deepchat question/reply to be 1 trace.
  Must land together with #3594090.
• #3563390 — Cases when getInput returns string.
• #3609260 — langfuse_ai_logging mis-forwards usage_details.
• #3616634 — Traces created from CLI (drush, cron, queue workers) are
  silently discarded.

Already landed, riding along in this release

• #3548465 — feedback support. Fixed and merged.
• The SDK pin (^1.2 → ~1.2.0) and the PHP floor
  (>=8.1 → >=8.2), committed directly and
  released as 1.0.2-alpha2. These did not wait for this meta issue:
  ^1.2 resolves SDK 1.3, which breaks the module at runtime with no
  build-time error, so every site running a fresh composer update
  was exposed. The PHP floor went with it because SDK v1.2.0 declares
  php: >=8.1 while six of its DTOs are readonly class,
  which is 8.2 syntax — PHP 8.1 sites resolved cleanly and then fatalled on
  parse.

Remaining tasks

• Create the 1.0.x branch from 1.x and make it the
  default branch.
• Decide whether Drupal 10 remains supported. All six .info.yml
  files currently declare ^10 || ^11; if D10 stays, it needs a real
  test run rather than an unverified claim.
• Land every blocker above.
• Full manual regression against a live Langfuse instance: chatbot, AI
  search logging, AI agents logging, feedback.
• Write release notes.
• Tag 1.0.2.

User interface changes

None.

API changes

See the individual child issues. The only intentional contract change in this
release is in #3594090, where "the current trace" stops being global state.

Data model changes

#3594090 removes two State keys
(langfuse_current_trace_id and langfuse_active_traces).
The second currently serialises entire SDK Trace objects into the
database.

Release notes snippet

First stable release. Fixes cross-request and cross-user trace leakage, makes
multi-turn Deep Chat conversations form a single coherent trace, fixes a fatal
error when the AI module supplies a plain string input, corrects usage detail
forwarding, and stops silently discarding traces created from Drush, cron and
queue workers.

This release requires PHP 8.2 or later and pins
dropsolid/langfuse-php-sdk to ~1.2.0. The 1.0.x line
will not move to SDK 1.3, which contains breaking changes. Sites wanting SDK 1.3
should move to the 1.1.x line once it is released.