chore(main): release 3.10.0-dk.1

[flant-team-sysdev]

🤖 I have created a release beep boop

3.10.0-dk.1 (2026-10-15)

Features

• build: fetch only the pinned commit of a submodule missing locally (#8070) (dae2c2d)
• deploy: own Helm-compatible release storage with streamed reads (#8061) (367a712)
• sbom: index the files an image actually ships (#433) (42f5d0a)

Bug Fixes

• build, stapel: recover interrupted file imports (#8074) (079791d)
• build: show git preparation in operations statistics (#8068) (b2cd0c4)
• build: skip cached stages with invalid image config sizes (#8065) (2f01f58)
• build: stop a lost task log from racing the live output of parallel tasks (#437) (236b3b8)
• cleanup: speed up and report metadata migration progress (#8078) (eb94043)
• sbom, vex, attest: stop a stale signed attestation from shadowing later unsigned builds (#421) (6c93b13)
• sbom: keep package installs on the manager, interpreter and lock the entry pins (#434) (a3f3bf2)
• sbom: keep the file locations of both duplicates when merging components (#427) (183a421)
• sbom: record os-pm packages pinned with @ as the attack surface (#423) (3014181)

Miscellaneous Chores

• force release 3.10.0-dk.1 (bb1c12e)

---

This PR was generated with Release Please. See documentation.

[flant-team-sysdev]

🤖 Created releases:

• v3.10.0-dk.1

🌻