chore(release): stamp v0.10.0

[remyluslosius]

Prepares v0.10.0. Does not tag it — that stays with the founder.

Version

0.10.0, a MINOR bump. The release is additive across the CLI, the check
methods and the corpus, and nothing was removed from a public surface.

The frozen api/ package changed in comments only. That was checked
mechanically rather than by eye — the diff since v0.9.0 contains no line that
is not a comment, so no signature moved. pkg/kensa gained two framework keys
and lost none.

What is in the release

37 commits since v0.9.0. Highlights: a measured NIST SP 800-171 coverage
denominator with derived CMMC Level 2 practice refs, list-valued rule
variables and a set_compare check method, a not_assessable_exit param so any
check can decline to reach a verdict, six remediation mechanisms classified as
control-channel sensitive, and identity rules gated on how the host resolves
users.

Three defects found while running the gates

Each is fixed in this PR.

Two merged features shipped with no changelog entry. The four antimalware
rules for 800-171 3.14.2, 3.14.4 and 3.14.5 (#374), and the measured 800-171
denominator with the derived CMMC Level 2 refs (#401). Both are user-visible
and would have gone out unannounced. Entries added.

The committed man/kensa.1 had drifted from the binary. It described
--config-dir as reading only defaults.yml, which stopped being true when
per-host, per-group and conf.d files landed, and it omitted --allow-conflicts
entirely. It also still carried two banned plan labels in that stale text. A
packaged manual page describing behavior the binary no longer has is worse
than no manual page. Regenerated; make manpage-check now passes.

The roundtrip-check and roundtrip-baseline guards never fired. RT_REPORTS
joins two wildcards, so with both empty it expands to a single space, and
test -n reads a space as non-empty. The guard fell through to a bare python
call and its argparse usage error. Fixed with strip, so both targets now print
the intended message.

Changelog consolidation

The Unreleased section had accumulated one Added/Fixed block per PR, about 35
headings. Released sections carry one heading per category, so the blocks were
merged into Added / Changed / Removed / Fixed. Entry text is copied verbatim,
and the merge was verified lossless by sorting the entry lines on both sides
and diffing them.

Gates

All green on this branch:

go test, golangci-lint (v2.12.2, 0 issues), specter sync + spec-coverage-strict
(148/148 specs), kensa-validate (779 rules, 0 errors, 1 known W005),
catalog-check, comment-lint, docs-check, docs-style, docs-style-sync,
mod-tidy-check, manpage-check, proto-check, cli-smoke (225/225 passed),
goreleaser check, and a release snapshot producing the documented 11 artifacts.

Security check

• govulncheck: no called vulnerabilities. 14 exist in required modules that
  the code does not reach.
• No dependency changed since v0.9.0. go.mod and go.sum are byte-identical, so
  this release adds no supply-chain surface.
• Secret scanning did not regress when the standalone job was removed. The
  pre-commit job still runs detect-secrets v1.5.0 against .secrets.baseline;
  the removal was deduplication. The exclusions are narrow and reasoned.
• The new list-variable and set_compare work does not create an injection path.
  set_compare does the comparison in Go and only the observing command, which
  is authored in the rule YAML, runs on the host. No list variable is
  interpolated into a command or run field anywhere in the corpus.

Two things the founder should decide before tagging

The guide still stamps v0.9.0. Every docs/guide chapter carries an
"Applies to: Kensa v0.9.0" line. docs-check does not gate those, so nothing
here fails, and I deliberately did not bump them. The stamp asserts the
chapter was verified command-by-command against the binary and the fleet, and
I did not do that verification. Re-stamping without it would turn a real claim
into a false one.

Tier 2 live validation has not run for this release. make roundtrip needs
a disposable host (RT_HOST), and it remediates and rolls back real state, so I
did not run it against the fleet without being asked. Everything above is
offline-green plus a container-free static pass, which the project's own
definition of done treats as necessary and not sufficient for anything that
writes to disk.

Unrelated, noted not changed

The shipped CLI help embeds a real fleet address and admin account
(192.168.1.211, owadmin) in about a dozen examples across cmd/kensa/main.go
and cmd/kensa-fuzz/main.go. It predates this range, so it is not a regression
and I left it alone. It is worth a follow-up: those examples ship to customers
in the binary and the manual page, and a documentation placeholder would carry
the same meaning without publishing internal topology.