cmake/template: document the mock-flag/Release-build guard pattern

[kcenon]

What

Add a documented pattern (and optional helper) to the template for the "prohibit a mock-only flag in Release builds" idiom.

pacs_system uses this in cmake/options.cmake:

if(PACS_USE_MOCK_S3 AND CMAKE_BUILD_TYPE STREQUAL "Release")
    message(FATAL_ERROR "PACS_USE_MOCK_S3 cannot be enabled in Release builds")
endif()

Proposed helper:

kcenon_template_forbid_in_release(<flag_var> [REASON <text>])
    Emit FATAL_ERROR if <flag_var> is truthy and CMAKE_BUILD_TYPE STREQUAL Release.

Why

Mock SDK flags, in-process test stubs, and similar developer-only options are dangerous in Release artifacts. Today each system writes the guard inline (or, more commonly, forgets to). A documented helper makes the pattern discoverable and uniform.

The pattern is multi-config-aware: on multi-config generators (CMAKE_BUILD_TYPE is empty), the check should be skipped because the per-config gate happens at build time -- the helper should handle that.

Where

• cmake/template/options.cmake (or new cmake/template/safety.cmake if the template grows more guard-style helpers)
• Document in template README under a new "Safety helpers" section
• VERSION bump: 1.0.0 -> 1.1.0 (MINOR)

How

Acceptance Criteria

• Helper added with multi-config guard built in
• Documentation entry in README
• At least one downstream consumer adopts (pacs_system can be the first via the existing PACS_USE_MOCK_S3 guard)
• VERSION bumped

Context

Discovered during the cmake-template alignment of pacs_system (kcenon/pacs_system#1140, part of kcenon/pacs_system#1137).