release: v0.10.0 -- supersede the never-published v0.9.1

[ChelseaKR]

Summary

• v0.9.1 was tagged and signed (commit edd2ea1) but its GitHub Release object was never created, so pypi-publish.yml never ran: PyPI's latest published version stayed 0.9.0 (v0.9.1 was tagged and signed but never actually released: PyPI and Docker still serve v0.9.0 #136).
• Sixteen PRs landed on main after that tag, including validator-behavior changes (fail-closed unreadable-file handling in TODS-E301/TODS-E303 and companion-GTFS reference checks, diff/batch coverage-manifest fixes, a new TODS-E207 rule) and a Python floor raise to >=3.12 (chore: raise Python floor to >=3.12 (CQ-01 / CAL-02) #72). Re-publishing the number 0.9.1 would misdescribe what actually ships, so this cuts 0.10.0 instead.
• Why 0.10.0 and not 1.0.0: the repo is still Beta (README, pyproject.toml classifiers), and docs/v1-contract-audit.md reserves v1.0.0 for a conformance-only release after the contract snapshot has gone unchanged for a full release cycle -- this release adds a rule and changes coverage-manifest behavior, so it does not qualify. Per docs/standards/RELEASE-AND-VERSIONING-STANDARD.md REL-05 (pre-1.0 SemVer may break in MINOR), the Python floor bump alone justifies MINOR over PATCH.
• v0.9.1's tag is left signed and unmoved; it's simply not the version anyone should install.

Changes

• pyproject.toml, CITATION.cff, uv.lock: version 0.9.1 -> 0.10.0.
• CHANGELOG.md: Unreleased section becomes a dated ## v0.10.0 - 2026-08-21 section, with a new paragraph explaining the version-jump reasoning above. Fresh empty Unreleased section added.
• README.md, .pre-commit-hooks.yaml: two stale @v0.9.1 pin examples updated to @v0.10.0.
• waivers.yml (WVR-002): project_version updated to 0.10.0 so the playground-pin waiver keeps naming the exact current gap. The playground pin itself stays at 0.9.0 in this PR -- it gets repinned to 0.10.0, and the waiver retired, in a follow-up PR once this release is confirmed live on PyPI (not before).

Test plan

• make verify green locally: lockfile, lint, format, typecheck, test (664 passed, 91.71% coverage), docs-check, contract-check, i18n-check, audit, secrets, npm-audit, a11y, citation.
• tests/test_playground.py::test_playground_installs_this_projects_version passes (waiver now correctly names the 0.9.0/0.10.0 gap).
• CI green on this PR.
• After merge: tag v0.10.0 (signed), create the GitHub Release, verify PyPI publish, then a follow-up PR repins the playground and retires WVR-002.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com