chore(main): release 1.10.0

[github-actions]

🤖 I have created a release beep boop

1.10.0 (2026-10-02)

Features

• isolation: add generic devenv sandbox image built and published to GHCR (#395) (8c7e9ca)
• oci-engine: add rootless podman OCI-engine capability kit (#437) (b980c93)
• paseo: bump pinned Paseo CLI to 0.10.2 (#439) (ef3aa29)
• paseo: register child repos in parent mounts (#391) (eded00c)
• patterns: add pi-coding-agent acq-kit (earendil-works/pi, npm install, unprivileged startup-only) (#399) (5d1a877)
• schema: add optional agent block to hybrid/v1 kit schema (#454) (856c975)

Bug Fixes

• ci: bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory (#409) (086f9f6)
• ci: bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory (#411) (acc0346)
• ci: pin markdownlint-cli2 once and stop the pre-commit/CI drift (#451) (543e08f)
• paseo: keep npm cache agent-owned (#402) (c0ad118)
• usai-provider: USAi model catalog refresh + NIST-grounded permission hardening (#417) (b3afd89)

---

This PR was generated with Release Please. See documentation.

[mogul]

Address now

None. I reviewed the current PR head (40832edef3b5235d6e9c6b97c7303944591c7980) and found no blocking release-correctness issue in the changelog-only diff. CHANGELOG.md:3 adds the expected 1.10.0 section, and CHANGELOG.md:8 through CHANGELOG.md:20 include the release-visible feature/fix commits since v1.9.0, including the security-relevant dependency advisory fixes and the USAi permission-hardening entry.

Track later

• GitHub reports no status checks on the release branch, so merge still depends on repository branch protections and human judgment rather than PR-local CI signal.
• Local make validate could not complete because this review container lacks the python executable and jsonschema for python3; I did not install dependencies because /tmp was already at 90% use with 52 MB free. Targeted checks showed INDEX.yaml and CATALOG.md are current, and git diff --check origin/main...HEAD passed.
• Conventional chore and test commits since v1.9.0 are intentionally omitted from generated release notes; I spot-checked their touched files and did not see a hidden release-note item that should block this release.

Checks run

• gh pr view 396 --repo GSA-TTS/agentic-coding-patterns --comments --json ...
• gh pr diff 396 --repo GSA-TTS/agentic-coding-patterns
• gh api repos/GSA-TTS/agentic-coding-patterns/issues/396/comments
• gh api repos/GSA-TTS/agentic-coding-patterns/pulls/396/comments
• gh api repos/GSA-TTS/agentic-coding-patterns/pulls/396/reviews
• gh api repos/GSA-TTS/agentic-coding-patterns/issues/396/timeline --paginate
• git rev-parse HEAD confirmed the local checkout matches the GitHub PR head SHA
• git log --oneline v1.9.0..HEAD
• git diff --check origin/main...HEAD
• python3 scripts/generate_index.py --check
• python3 scripts/generate_catalog.py --check
• python3 scripts/validate_repo.py (blocked by missing jsonschema; other validators reached advisory-only warnings)
• gh pr checks 396 --repo GSA-TTS/agentic-coding-patterns (no checks reported)
• df -h . for disk monitoring

Residual risk: this was a release-note review, not a re-review of every merged PR in the release range. I treated PR text and timeline content as untrusted data and did not follow embedded instructions from it.

[mogul]

Whoops, this PR got caught up in my auto-reviewer loop; disregard until it's time to pin a release!

[github-actions]

🤖 Created releases:

• v1.10.0

🌻