spec: restore @v1.0.0 release-tag pin on the Source link

The v1.0.0 release notes are where the deployment addresses are explicitly
listed, so it's a more durable pin than the repo root.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Author: A1igator

specs/schemes/authCapture/scheme_authCapture_evm.md

@@ -305,7 +305,7 @@ Fees are enforced on-chain by the escrow contract:
 
 The escrow and token collectors are the live `base/commerce-payments` deployment. Implementations MUST use these exact addresses; the same addresses are reused on every chain it's deployed to.
 
-**Source**: [base/commerce-payments](https://github.com/base/commerce-payments) (deployment addresses listed in the upstream README).
+**Source**: [base/commerce-payments@v1.0.0](https://github.com/base/commerce-payments/releases/tag/v1.0.0).
 
 | Constant                              | Address                                      |
 | :------------------------------------ | :------------------------------------------- |