chore(release): bump main to 0.10.1 and cut the changelog entry

[pat-lewczuk]

What

Stamps the release set (contract, api-client, cezar, web, alias-cezar) and the lockfile 0.10.0 -> 0.10.1, rewrites the intra-release ^0.10.0 ranges to ^0.10.1, and cuts the 0.10.1 CHANGELOG.md entry for everything merged since v0.10.0.

Patch bump: everything since 0.10.0 is a feature or a fix, nothing breaking.

Changelog

• Kept the five entries already drafted under # Unreleased (pin tasks, agent-account Continue, the CEZ:ASK brace repair, the merge-conflict chip, the three reference-chip fixes) and fixed their citations — the pin feature cited its tracking issue (#935) rather than the PR that shipped it (#938); the CEZ:ASK and merge-conflict entries had no PR citation at all.
• Added the ~14 PRs merged since v0.10.0 with no changelog note: PDF/TXT/MD composer attachments (feat(composer): accept PDF, TXT and MD attachments, not just images #951), cross-repo reference-chip safety (fix(runs): stop a task adopting another repository's PR/issue as its reference (#945) #946, fixes Fix: a task adopts another repository's PR/issue link as its own reference chip #945), a stale review request or an "Update branch" merge clearing a rejection (fix(github): stop a stale review request or an "Update branch" merge from clearing a rejection #909), cross-project task 404s (fix(cockpit): open another project's task without a 404 #905), the Changes tab's independent scroll (fix(cockpit): scroll the Changes file tree independently of the diff #918), a clearable composer skill pill (fix(composer): let a picked skill be taken back off, and open every task without one #919), a resumed session keeping its step's tools (fix(runs): a resumed session keeps its step's tools instead of the default set #928), Alt quick replies eating Polish characters (fix(composer): stop the Alt quick replies from eating typed characters #943), host-local Claude model discovery (fix(models): discover Claude models from the host CLI instead of fixed presets #841), GitHub search across every state (fix(github): find issues and PRs in any state from the tab's search (#730) #732, fixes Fix: GitHub tab search cannot find closed/merged issues & PRs — only the open set is ever fetched #730), two mobile run-header/history fixes (fix(web): reclaim mobile task history space #764, fix(ui): collapse dense run metadata at phone width (#765) #873, fixes Fix: collapse dense run metadata in the session header #765), and a fresh task's /skill expansion (fix(workflows): expand /skill in a fresh run's opening prompt (#278) #947).
• Added a ## 🚀 CI/CD & Infrastructure section for the GITHUB_RUN_ATTEMPT e2e fix (fix(release): pin GITHUB_RUN_ATTEMPT so CI re-runs stop failing the snapshot e2e #911).
• Added a ## Highlights paragraph and credited the seven contributors: @pat-lewczuk, @wojciechszyjka, @piotrchabros, @blabbler78, @matgren, @AGmakonts, @patzick.

Verification

Docs-only, no code changes — every touched package.json, the lockfile, and CHANGELOG.md parse/read cleanly. No test/build gate needed beyond that (matches the precedent 0.10.0 release commit, #892).

🤖 Generated with Claude Code

[github-actions]

📦 npm preview published — 0.10.1-pr962.1431

Try this PR build (exact pinned version — copy-paste as-is):

npx cezar-cli@0.10.1-pr962.1431                                # cockpit at http://localhost:4321
npx cezar-cli@0.10.1-pr962.1431 run "…"                        # headless run
npx cezar-cli@0.10.1-pr962.1431 server-deploy --platform <id>  # roll a server to this exact build

Also tagged: npm install -g cezar-cli@pr-962 (moving tag for this PR).
Packages: cezar-cli@0.10.1-pr962.1431 → @open-mercato/cezar@0.10.1-pr962.1431 → @open-mercato/cezar-api-client@0.10.1-pr962.1431 (provenance attested).