Release 0.10.0

CHANGELOG.md

@@ -10,6 +10,19 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-08-17
+
+A security release. The Windows installer left the directories it creates
+writable by every logged-on user, which made two of the files it puts there a
+local privilege escalation; that is fixed and verified on Windows. Alongside it,
+the work that makes this product genuinely adoptable by a second site: one
+site's hostnames, share paths and networks are out of the product code and out
+of the published documentation, and the rule that keeps them out now fails the
+build rather than printing a warning nobody read.
+
+The plugin contract moved to 0.19.0, which is a BREAKING change - see the
+Changed section and CONTRACT-STABILITY.md before upgrading a plugin you wrote.
+
 ### Added
 
 - Applications accept an uploaded image and an uploaded installer, rather than