Bump to v0.10.0 and guard public-surface drift in CI

[pengfei-threemoonslab]

Summary

• Bumps agents-shipgate to v0.10.0 and aligns every public / agent-facing surface (pyproject, .well-known, llms.txt, contract doc, README, docs, all GitHub Actions / CircleCI / GitLab-CI examples, prompts, skills) to a single canonical package version, GitHub Action pin, and shipgate_version input.
• Fixes packet-schema drift: llms.txt and skills/agents-shipgate/SKILL.md referenced packet-schema.v0.2.json while the contract was already at v0.3; SKILL.md also linked the broken anchor #release-evidence-packet-v01.
• Replaces the longest restated field lists in AGENTS.md and skills/agents-shipgate/SKILL.md with links to docs/agent-contract-current.md anchors so future schema bumps update one file, not five.
• Adds eight new drift-detection tests in tests/test_public_surface_contract.py so CI fails on stale Action pins, stale package versions, stale report/packet schema links, stale packet anchors, and forbidden display names (Agent Shipcheck / Agent Shipgate) outside explicit "do not use" lists. The existing summary.status negative test already covers "new gating signal" drift.

Type

• Check or risk-model change
• Input adapter change
• CLI or GitHub Action behavior
• Report, schema, or SARIF output
• Documentation only

Verification

CI is authoritative for python -m ruff check ., python -m compileall -q src tests, and python -m pytest.

Additional local checks run:

• python -m pytest -q → 677 passed
• python -m pytest tests/test_public_surface_contract.py -v → 172 passed (was 30 pre-bump; the new parametrized tests run across PUBLIC_SURFACES and a new ACTION_PIN_FILES superset of 33 files)
• python -m ruff check . → clean
• grep -rn \"@v0\\.[0-9]\\+\\.[0-9]\\+\" --include='*.md' --include='*.yml' --include='*.yaml' --include='*.txt' --include='*.json' . | grep -v -E 'CHANGELOG|marketing|samples|tests' | grep -v '@v0\\.10\\.0' → empty (no remaining stale Action pins outside historic files)
• grep -rn \"packet-schema\\.v0\\.[0-9]\" --include='*.md' --include='*.json' --include='*.txt' . | grep -v -E 'CHANGELOG|docs/packet-schema' | grep -v 'v0\\.3' → empty (no remaining stale packet-schema references)

Release-readiness notes

• No user-code import added to default scan paths
• No network access added to default scan paths
• New or changed check IDs are documented in docs/checks.md (no check changes in this PR)
• Report/schema changes are additive or documented in STABILITY.md (no schema changes; only metadata version bumps to match the already-released report-schema v0.10 / packet-schema v0.3)

Notes for reviewers

• The v0.10.0 git tag does not yet exist. This PR bumps in-tree metadata; cut and publish the tag separately when merging. The new tests intentionally do not assert tag existence (that would block this PR). Tag existence is enforced by the release workflow at publish time.
• marketing/linkedin-launch-post.md keeps its @v0.5.1 pin (frozen launch copy for that specific release) and is explicitly excluded from ACTION_PIN_FILES.
• Frozen schema files (docs/{report,packet}-schema.v0.X.json) are also excluded — their $id necessarily names their own frozen version.
• examples/github-actions/README.md:45 documents the Action output named decision as "the gating signal". The plan deliberately doesn't add a positive release_decision.decision-must-be-mentioned test because it would false-positive there; the existing summary.status negative test plus .well-known.gating_signal are the right guard.

🤖 Generated with Claude Code