Release 0.10.0

[jothimani-rajendran]

What

Version to 0.10.0 in pyproject.toml, CITATION.cff, action.yml and docs/installation.md; the Unreleased changelog section becomes 0.10.0 — A script gate's evals replay, and its ambient line names the script by file; social preview regenerated for the new version string. Same shape as the 0.9.3 release commit.

Minor rather than patch, under CONTRIBUTING's emitter-stability rule: #156 changed the script gate's ambient line, which is emitted output, and its golden moved with it. Nothing published uses the kind yet, so an adopter sees no change; the number follows the rule rather than the blast radius. If you would rather call it 0.9.4, say so and I will re-cut.

After merge, the tag v0.10.0 on the merge commit triggers release.yml (wheel/sdist, PyPI via Trusted Publishing, binaries, GitHub Release); its guard step checks the tag against pyproject.toml. Then chock-catalog adopts it (tools/adopt_framework.py v0.10.0), which is what lets java-security move onto the script gate with replayable evals.

Definition of done

• chock check → 0 errors, 0 warnings (5 pre-existing infos)
• chock check --only matrix unchanged by this PR (no code change)
• chock sync --repo . --check clean
• chock check --only verify clean
• Registry unchanged; nothing to rescan
• pytest -q green: 1428 passed, 2 skipped
• pytest acceptance/ -c acceptance/pytest.ini --rootdir=acceptance green: 21 passed
• Existing artifacts: none affected
• Touched manifests: none
• ruff check . and ruff format --check . clean
• docs/assets/gen_brand_assets.py --check: social-preview.svg current at v0.10.0

Claims

• No surface is described as enforcing more than it installs; this PR changes version strings and a changelog heading only.

🤖 Generated with Claude Code

---

Generated by Claude Code