chore(release): prepare v0.10.0

[owainlewis]

Summary

Prepare v0.10.0 with a safe, backup-first upgrade path. Configured older assistant repositories can now be completed without replacing user files, while invalid Git metadata still fails before scaffolding. The managed Push skill and operator docs cover the new JSON, path, status, migration, and service-security behavior.

Reviewer notes

The live-host audit found and this PR fixes partial-layout upgrade failure, incomplete managed-skill guidance, contradictory job workdir documentation, missing migration ordering, and launchd log permissions. The live Slack credential issue is host configuration, not part of this repository change.

Proof

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked: 401 unit, 3 docs, 14 init CLI, 14 JSON CLI, 3 crash tests
• cargo build --locked --release
• bash tests/install.sh
• bash tests/release-version.sh
• mkdocs build --strict
• plutil -lint examples/launchd/com.owainlewis.push.plist
• independent final review: approved with no findings
• GitHub CI pending on the latest commit

[owainlewis]

Final release gate: all configured checks pass on commit 2d4df4d, including Linux, macOS, docs, and RustSec. The first Ubuntu run hit the existing timing-sensitive live/stale claim test; an unchanged failed-job rerun passed. Local exact-state proof and independent review remain green.