chore(main): release 0.10.0

[github-actions]

🤖 I have created a release beep boop

0.10.0 (2026-09-05)

Features

• brand: add animated hero GIF + demo GIF + hero motion spec (61ee5a2)
• ci: isolate CI user-state via ENVMANAGER_LOCALAPPDATA redirect seam (issue 24) (c6d4dc8)
• preflight: two-tier profile validation with warn tier, --strict, and exit code 2 (issue 19) (58072a0)
• scripts: add check-readme-i18n.ps1 and record-demo.py helper scripts (528d651)
• scripts: add rsvg-convert wrapper scripts (JS + cmd) using @resvg/resvg-js (c7d7750)

Bug Fixes

• ci: add missing cargo test --locked steps to build.yml verify job (afa2ae3)
• ci: compare PATH semantically (entry list, case-sensitive) instead of byte-exact - CLI normalizes empty segments on write, CI image PATH is dirty by construction (152a951)
• ci: doc-sync expects docs/i18n/README.zh_CN.md (README_CN.md superseded by i18n suite); local AGENTS.md has no stale refs (45a5ba3)
• ci: drop unused HITS var in wix-watchdog (actionlint SC2034 - HITS computed but never read) (cad1905)
• ci: MSI smoke probes installed CLI with bare args (build.mjs version-probe protocol); CLI has no --version flag (fc53ad2)
• ci: package job installs WiX 3.14 to %LOCALAPPDATA%\tauri\WixTools314 (windows-2025 image no longer bundles it); build.mjs copies loose exes beside ZIPs to match release layout contract (d082a9c)
• ci: pass -CliExe pointing to Release binary so test-with-restore.ps1 finds CLI on CI (was defaulting to release/cli-only which CI never builds) (0d3cb9c)
• ci: PATH snapshot compares entries semantically (case+order), folding empty-segment noise the CLI normalizes on write on dirty CI images (516dcbf)
• ci: pin WIX env to extracted WixTools314 path (windows-2025 image preset WIX shadows it with a removed dir) (c0b9e69)
• ci: replace rustsec/audit-check (v2.0.0 'Unexpected end of JSON input' bug) with taiki-e/install-action + cargo audit on both workspaces (40ac008)
• ci: restore all workflow failures - build.yml YAML corruption, mirror action input rename, release-please dead SHA (e8ad626)
• ci: run root npm ci in package job so scripts/build.mjs finds archiver (ERR_MODULE_NOT_FOUND) (5cfb7a9)
• ci: seed frontendDist placeholder for generate_context! in verify (issue 17) (96abc6b)
• deps: archiver v8 is ESM with named exports - use ZipArchive class (fixes 'does not provide an export named default' in package job) (ff63983)
• deps: regenerate lock with npm 10 (CI Node 20=npm 10; npm 11-generated lock failed npm 10 ci peer validation on esbuild@0.28.2) (e05e6a4)
• deps: revert bits-ui to 0.22.0 (v2 peer-requires Svelte 5; project on Svelte 4 chain) (b114ed4)
• engine: route test-with-restore launch target away from System32 and sync docs after enforced guard (issue 04 B1) (828af15)
• frontend: regenerate package-lock.json against registry.npmjs.org; pin registry via .npmrc (npmmirror cache caused version-graph mismatch breaking npm ci in CI) (b079c39)
• frontend: sync package-lock.json with package.json (npm ci EUSAGE in CI) (4a9f43a)
• l1: harness PutSecretValue ClientRequestToken; vault bounded health poll replaces query-string wait (issue 15) (61891ad)
• l1: SigV4 ClientRequestToken idempotency token; vault dev-server -dev command (issue 15) (112dd0d)
• l1: wire Azure vault URI env, SigV4 header validation bypass, SecretStore round-trip gate, serialize container fixtures; record 1password linux stack overflow (issue 15) (a478b9d)
• preflight: make %VAR% defined-check hermetic via process env (issue 19 rework 2) (b64b6fd)
• profile: recognize --help/-h/-?//? in profile create name position as help request (issue 20) (4f6f7db)
• test: preserve CLI stderr on failure and stamp round-trip name (issue 22+24) (3890e6a)
• test: replace hardcoded D:/Aworker absolute paths with repo-relative resolve() in secret tests (CI runner has no D:/Aworker) (fc8ada3)
• test: use unique fixture path C:\EM_TEST_TRAILING_BACKSLASH\ in trailing-backslash case (PS7 install dir may preexist in CI runner user PATH, breaking snapshot equality) (1c6ef82)

---

This PR was generated with Release Please. See documentation.