chore(release): v0.10.0

Two user-visible features -- the app can update itself, and it can hand
you a redacted diagnostics bundle -- plus the supply-chain, release
integrity and build work behind them.

A minor bump rather than a patch, matching how v0.9.0 was cut off v0.8.2
for a single new user requirement. This one carries two (UR-077,
UR-078), both with UI in Settings.

The CHANGELOG entry is the release body now: build-release.yml publishes
the `## v0.10.0` section and fails if it is missing, instead of the fixed
block of install instructions that every release from v0.0.1 to v0.9.1
carried verbatim.

CHANGELOG.md

@@ -9,6 +9,105 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).
 
+## v0.10.0
+
+Two things you can see, and a great deal of work on how this project builds and
+ships itself. The app can now update itself, and it can tell you what it did
+when something goes wrong — both of which existed as gaps rather than as bugs,
+which is why they lasted so long.
+
+### ✨ Changes
+
+- **JellyTau can update itself.** Anyone who installed an AppImage or ran the
+  Windows installer was frozen on that version permanently: nothing in the app
+  ever mentioned that a newer one existed, and the release page was the only
+  announcement. Settings → Updates now checks, shows what changed, and installs
+  and restarts on request. Each download is verified against JellyTau's signing
+  key before anything is installed, so a substituted file is refused rather than
+  run. Android is deliberately not wired to this — an app may not replace its own
+  APK, that is the system installer's job — and is given a link to the releases
+  page instead of a button that would fail. (UR-077 → DR-217)
+
+- **You can export a diagnostics bundle.** Until now the app forgot everything it
+  had done the moment it closed. Logs went to standard output, which nobody sees
+  when launching from a desktop icon, and on Android went nowhere at all — so the
+  backend was invisible on the platform where the hardest playback bugs live. A
+  crash left nothing behind. Logs are now kept in a size-capped file that
+  survives a restart, a crash is recorded before the app dies, and Settings →
+  Diagnostics exports the lot as one file to attach to a bug report. Access
+  tokens and passwords are stripped before anything is written to disk, not
+  merely before it is exported. Nothing is transmitted anywhere; you attach the
+  file yourself. (UR-078 → DR-218)
+
+- **Linux gets an AppImage again.** The release notes have advertised one for
+  months while the build never produced it — the packaging step looked for the
+  file, found nothing, and said nothing. (DR-217)
+
+### 🐛 Fixes
+
+- **Releases no longer ship every Windows installer ever built.** Every release
+  from v0.1.0 to v0.8.2 carried its predecessors': sixteen installers on v0.8.2,
+  thirteen of them stale, and a download list on v0.5.0 reaching back to 0.1.0.
+  The build directory is never cleaned and the build machine reuses it, so each
+  release collected whatever was left behind. It went unnoticed for eight months
+  because nothing looked wrong — the files were real and the page merely looked
+  busy. The stale files have been removed from the published releases, the build
+  now clears that directory first, and a check refuses to publish a release
+  containing an artifact from a different version. (DR-220)
+
+- **Release notes now say what changed.** All 35 previous releases published the
+  same block of generic install instructions, whose "What's New" section was a
+  link to a file that does not resolve from a release page. Every release page
+  now carries its own entry from this changelog, and the past ones have been
+  filled in. (DR-219)
+
+### 🔒 Security and supply chain
+
+- **Dependencies are now checked against a vulnerability database on every
+  build.** They never had been. The first run found eight vulnerabilities and one
+  unsoundness in the Rust dependency graph — all of them fixed by an update
+  nobody had a reason to run. Licences are checked against an allow-list too, so
+  nothing gets redistributed inside a release that does not permit it.
+  (DR-216)
+
+- **Every release publishes checksums and a bill of materials.** `SHA256SUMS`
+  lets you verify a download (`sha256sum -c SHA256SUMS`); the SBOM lists what
+  went into the build, so "does this release contain <vulnerable library>?" has
+  an answer that is not "rebuild it and find out". (DR-216)
+
+- **Builds are reproducible again.** Every CI job named a container image tag
+  that was rewritten in place, so rebuilding an old release did not necessarily
+  rebuild the same thing. Jobs now pin an immutable tag. The one dependency that
+  comes from a git branch rather than a package registry is pinned to an exact
+  revision, closing a path by which new upstream code could arrive unreviewed in
+  a library linked into the player. (DR-216)
+
+### 🧹 Under the hood
+
+- Formatting, linting and type-checking now run in CI. All three were configured
+  and enforced by nothing: 199 files did not match the project's own formatter, a
+  type error could sit on the main branch until somebody cut a release, and the
+  test-coverage command had been broken for months by a dependency mismatch.
+  Coverage now has a floor that only moves up. (DR-215)
+
+- The traceability matrix counts requirements implemented by configuration.
+  Several carried the necessary annotations and were being counted as uncovered
+  because the extraction tool only read source files. (DR-215)
+
+- The project now has a security policy, contribution guide, code of conduct,
+  issue and pull-request templates, and an operations document covering the
+  builder image, the release secrets, and what losing the signing key would mean.
+
+- The app framework moved from Tauri 2.9.5 to 2.11.5. Nothing about this is
+  visible in use, but it is worth recording that it did not go quietly: the
+  windowing layer beneath Tauri quietly stopped publishing the Android JavaVM
+  and application handle that this app's credential storage had been reading for
+  its whole life. Nothing here had changed; a side effect several dependencies
+  down had simply gone away, and the app aborted on launch on every Android
+  device. JellyTau now sets that handle itself rather than relying on someone
+  else to do it. Caught by installing on a real tablet before release — no test
+  suite runs the app. (UR-012 → DR-223)
+
 ## v0.9.1
 
 A one-line fix to the home screen, released on its own because it is the kind of