release: strict ZIP64 and gzip-wrapped portable ustar (Alpha.10)

[blisspixel]

Summary

• Add the explicit Zip64StrictAsciiV1 profile without widening or auto-detecting the ZIP32 default.
• Add strict single-member RFC 1952 gzip composition over portable ustar with a bounded private derived snapshot, exact transform identity, independent wrapper and TAR audits, and sealrTreeV4.
• Keep zero new runtime dependencies and pin exact Linux, macOS, and Windows dependency closures.
• Add public ZIP64 and gzip-TAR conformance vectors, independent identity verification, deterministic hostile corpora, and scheduled Ubuntu AddressSanitizer fuzz campaigns.
• Preserve fail-closed worker behavior until semantic-record v3 can represent the new formats.
• Prepare the coherent 0.1.0-alpha.10 package, documentation, release checks, and immutable release notes.

Verification

• cargo fmt --all -- --check
• Strict workspace Clippy with warnings denied
• cargo test --workspace --all-targets --all-features
• Documentation and finding-code verification
• Exact dependency budgets for Linux, macOS, and Windows
• Deterministic fuzz-seed reproduction for all six targets
• Package contract and independent identity-vector verification
• Exact Alpha.9-to-Alpha.10 security diff scan with complete coverage and zero findings
• Documentation-only follow-up security diff scan with complete coverage and zero findings

The required Ubuntu CI supplies the Bash plus jq release-candidate fixture and the supported sanitizer environment.