Problem

Two documentation SSOT defects found by the 2026-06-13 analysis:

• README.md:180 instructs consumers to FetchContent ... GIT_TAG v1.0.0, a tag that does not exist (quick win — breaks every copy-paste integration).
• DEPENDENCY_MATRIX.md (self-declared ecosystem SSOT) is a 2026-03-06 snapshot: the internal-pin table still shows v0.1.0/v0.2.0/v0.3.0 though thread/container/database carry real v1.0.0 tags; third-party rows are stale (OpenSSL 3.3.0->3.4.1, spdlog 1.13.0->1.15.3, gRPC 1.51.1->1.60.0, Protobuf 3.21.12->4.25.1, libpqxx 7.9.0->7.9.2). The root copy and docs/advanced/DEPENDENCY_MATRIX.md also differ.

Scope / Acceptance Criteria

• Point the FetchContent example at v0.2.0 until the real v1.0.0 tag lands (or update it as part of the tag cut, Track ecosystem-wide v1.0 API stabilization readiness #639)
• Refresh DEPENDENCY_MATRIX internal-pin + third-party rows to current vcpkg.json reality
• Mirror or de-duplicate the two matrix copies (root vs docs/advanced/)
• (Forward) the version-drift gate should keep this table from re-staling