ci: gate tines-core 1.x changes against the published 1.0.0

cargo-semver-checks with a pinned 1.0.0 baseline in scripts/ci.sh (skipped
where the tool is absent); the GitHub Actions ci job installs a prebuilt
binary so the gate is enforced there.

.github/workflows/ci.yml

@@ -42,6 +42,14 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libdbus-1-dev pkg-config
 
+      # The semver gate in scripts/ci.sh compares tines-core against the
+      # published 1.0.0; a prebuilt binary keeps this fast (a from-source
+      # install would dominate the job).
+      - name: Install cargo-semver-checks
+        run: |
+          curl -LsSf https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar xzf - -C "$HOME/.cargo/bin"
+          cargo binstall --no-confirm cargo-semver-checks
+
       - name: Run CI gate
         run: sh scripts/ci.sh
 

scripts/ci.sh

@@ -24,3 +24,10 @@ sh scripts/check-no-std.sh
 # compiling on the pinned stable toolchain, or the scheduled job rots unseen.
 cargo fmt --manifest-path fuzz/Cargo.toml -- --check
 cargo clippy --locked --manifest-path fuzz/Cargo.toml --all-targets -- -D warnings
+# Post-1.0.0 release gate: every 1.x change to tines-core must stay
+# semver-compatible with the published 1.0.0. Skipped where the tool is not
+# installed (`cargo install cargo-semver-checks --locked`); the GitHub Actions
+# `ci` job installs a prebuilt binary so the gate is enforced there.
+if command -v cargo-semver-checks >/dev/null 2>&1; then
+    cargo semver-checks check-release -p tines-core --baseline-version 1.0.0
+fi