chore(release): 0.10.0

[stephane-segning]

1. Summary

This PR changes:

• Bumps all eleven workspace packages from 0.9.0 to 0.10.0.
• Splits the CHANGELOG.md [0.9.0] "unreleased" entry: the two models-info bullets and the fast-uri fix move into a new [0.10.0] — 2026-07-28 section; [0.9.0] is corrected to 2026-06-29 (its actual npm publish date) and keeps only what that publish really contained.

It solves:

• @vymalo/opencode-models-info@0.9.0 was already live on npm since 2026-06-29 — confirmed by downloading the published tarball (registry.npmjs.org/.../opencode-models-info-0.9.0.tgz) and finding no trace of modelsInfoHideTextOnly, reconcileModel, or startCacheRefreshSchedulers, and no scheduler.js in dist/ at all. Two merged PRs — #68 (modelsInfoHideTextOnly + periodic refresh scheduler) and #70 (fast-uri audit fix) — landed on main under the still-0.9.0 version line. Re-running publish.yml (run 30378199556) showed all 7 npm publish steps green, but every one logged already on npm — skipping — the workflow's own guard against overwriting an already-published version, which means none of that work actually reached npm.

---

2. Intent

The intent of this PR is:

Move the version line past the already-shipped 0.9.0 so publish.yml can actually publish the models-info work and the security fix, instead of silently no-op'ing against an npm version that predates both.

---

3. Scope

In Scope

• Version bump: all 11 package.json files, 0.9.0 → 0.10.0.
• CHANGELOG.md: re-date [0.9.0] to its real publish date, add [0.10.0] with the content that's actually new since that publish.

Out of Scope

• Any further code changes — this is purely a version/changelog bump PR, same pattern as the 0.8.1 release commit.
• Re-triggering publish.yml — happens as a separate workflow_dispatch after this merges.
• Fixing the Chrome Web Store extension submission (invalid_grant on CHROME_REFRESH_TOKEN — that secret needs to be regenerated outside this repo; unrelated to the version/npm issue this PR fixes).

---

4. Verification

I verified this change by:

• Running automated tests
• Checking logs
• Running manual tests
• Checking metrics
• Testing error cases
• Testing permissions/security behavior
• Testing rollback or failure behavior, if relevant

Commands run:

grep -rn '"version": "0.10.0"' --include=package.json .   # confirm all 11 bumped, none left at 0.9.0
pnpm install                                               # confirm no lockfile drift from the bump
pnpm -r build
pnpm -r typecheck
pnpm coverage
pnpm lint
pnpm format:check
pnpm audit --audit-level=high --prod

Results:

All 11 package.json files report "version": "0.10.0"; no remaining 0.9.0.
pnpm install: "Lockfile is up to date, resolution step is skipped" — no lockfile changes.
pnpm -r build / pnpm -r typecheck: all packages succeeded.
pnpm coverage: all packages passed their per-package thresholds, exit 0.
pnpm lint / pnpm format:check: no issues (242 files checked).
pnpm audit --audit-level=high --prod: 5 vulnerabilities found, Severity: 1 low | 4 moderate — exit 0 (no high/critical, confirms #70's fix still holds).

---

5. Screenshots / Evidence

Add evidence here:

• Screenshot: N/A
• Logs: failed publish evidence — run 30378199556, all 7 npm steps logged already on npm — skipping; npm tarball inspection confirmed above
• Metrics: N/A
• Recording: N/A

---

6. Risk Assessment

Risk level:

• Low

Potential risks:

• None beyond the version/changelog edit itself — no code changes, no lockfile changes.

Mitigation:

• N/A

---

7. AI Usage Declaration

AI was used for:

• Understanding existing code
• Drafting documentation
• Generating code
• Refactoring
• Generating tests
• Reviewing the diff
• Not used

Human verification:

• I understand every meaningful change in this PR
• I checked generated code manually
• I checked generated tests manually
• I removed unsupported AI assumptions
• I accept responsibility for this PR

---

8. Reviewer Focus

Please focus your review on:

• Correctness
• Architecture
• Security
• Performance
• Tests
• Maintainability
• Product intent
• Edge cases

[changeset-bot]

⚠️ No Changeset found

Latest commit: b05d30f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

✅ AI Governance check passed

This PR declares AI usage, references a source of truth, and provides verification evidence. Thank you.