chore(release): prepare v0.10.0

[JacobOptimiza]

Summary

• Bump DevNav and all distribution metadata to 0.10.0.
• Finalize the first multichannel release preparation.
• Separate npm package construction/testing from npm publication.
• Upload the exact tested npm tarball as a workflow artifact.
• Gate npm Trusted Publishing behind NPM_TRUSTED_PUBLISHING_ENABLED.
• Keep the first npm publication manual while the package does not yet exist.

npm publication behavior

First release:

• npm-package: runs and uploads the verified .tgz.
• npm-publish: skipped.

Later releases after Trusted Publishing setup:

• npm-package: runs.
• npm-publish: stages the exact previously tested .tgz through OIDC.

No NPM_TOKEN is introduced.

Version

0.10.0 is synchronized across:

• Cargo.toml / Cargo.lock
• powershell/DevNav.psd1
• packaging/npm/package.json
• packaging/scoop/devnav.template.json
• CHANGELOG

npm and Scoop are still documented conservatively until their public bootstrap/publishing steps are completed.

Validation

• Rust gates: PASS
• cargo deny / machete / audit: PASS
• PowerShell validation: PASS
• Pester: 24/24 PASS
• npm tests Node 22/24/26: 11/11 PASS
• npm pack allow-list: PASS
• workflow structural validation: PASS
• npm permission separation: PASS
• explicit tested-tarball publication path: PASS
• git diff --check: PASS

No merge, tag, GitHub Release, npm publish, Trusted Publisher, npm-production setup, Scoop bucket/bootstrap, or WinGet mutation is included.