Prepare ONNX Runtime 1.28.0-r1 release

[laurens-pilot]

What changed

• pin upstream ONNX Runtime to the final v1.28.0 tag
• reset the stable packaging revision to r1
• update release documentation, examples, and changelog for 1.28

Why

ONNX Runtime 1.28.0 is now available, including its security/runtime fixes and WebGPU plugin EP 0.3.0. This prepares a fresh native build of every supported target using the repository's immutable release workflow.

Validation

• confirmed upstream tag v1.28.0 resolves to da9b5e364c465de65c49d91e696cd6485270757f
• applied both maintained patches cleanly to that exact commit
• verified all build flags used by the packaging scripts remain present upstream
• passed shell syntax/lint and JSON checks
• compiled the portable runtime smoke test against the 1.28.0 headers