docs(v1.10.1): cut v1.10.1; v1.10.0 stays tagged-but-never-published

v1.10.0's build failed one assertion of 104 and published nothing. Rather than
re-point a tag CI had already consumed, the number moves: a version that failed
its build should stay failed and readable, not be quietly overwritten with
different bytes.

CHANGELOG gains a v1.10.1 section carrying the smoke fix (moved out of
v1.10.0's Fixed list), and states plainly that everything under v1.10.0 ships
here so the big section stays the content record. v1.10.0's heading is marked
"tagged, never published — superseded by v1.10.1" with a blockquote naming the
commit (12f99c4), the run (704), the four jobs that skipped, and the fact that
no image carries the tag.

Pre-tag doc sweep, because CI reads docs from the TAG and POSTs DOCKER_HUB.md
to the Hub as full_description:

  - README "Terminal UI mode: fullscreen is the default (since v1.10.0)"
    -> v1.10.1. A "since" marker pointing at an image nobody can pull is a
    worse lie than no marker.
  - Dockerfile.variant decision comments for the pi and pi-atelier bumps
    -> v1.10.1 (these describe which release carries the change).
  - scripts/smoke-test.sh deliberately KEEPS "the v1.10.0 tag build" — that
    one is a historical event and v1.10.0 is its correct name.
  - DOCKER_HUB.md needed no change: its fullscreen note is version-free.

No code changes. RELEASE_TAG is derived from github.ref_name, so nothing in the
build hardcodes the version.

Base layer does NOT rebuild: no base input (Dockerfile.base, rootfs/**,
entrypoint.sh, entrypoint-user.sh) has changed since 12f99c4, so base-decide
will cache-hit base-dad0f365ff24, which run 704's build-base already pushed at
07:52:38Z. This retry skips the expensive half.

Gates: doc-drift 23 OK / 0 DRIFT / 0 SKIP; base-hash, workflow-shell,
skill-floor, lint-shell all rc=0.

CHANGELOG.md

@@ -11,7 +11,62 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## v1.10.0 — 2026-10-02
+## v1.10.1 — 2026-10-02
+
+**v1.10.0 was tagged and never published.** Its tag build (run 704) failed one
+assertion out of 104 — a smoke check that required a pi dependency upstream had
+deliberately deleted — so every publish job skipped and no image, no `latest`,
+no Hub description was ever written. v1.10.1 is that same release plus the fix
+to the assertion: **everything described under v1.10.0 below ships here**, and
+that section remains the content record for this release. Nothing in it changed.
+
+The tag number moves rather than being re-pointed because CI had already
+consumed v1.10.0; a version that failed its build should stay failed and
+readable, not be quietly overwritten with different bytes.
+
+### Fixed
+
+- **The smoke suite asserted a pi dependency that upstream deleted, and it cost
+  this release its first tag build** — `scripts/smoke-test.sh` required
+  `@mariozechner/clipboard` to be installed and `require()`-able at every install
+  site. pi **0.86.0** (`#9163`) *"Replaced the external native clipboard
+  dependency with bundled asynchronous macOS, Windows, and X11 helpers while
+  preserving platform command and OSC 52 fallbacks"*. Measured in the published
+  tarballs: pi `0.85.1` declares `@mariozechner/clipboard@0.3.9`; `0.87.1` and
+  `1.0.0` declare no `@mariozechner/*` at all. So on a correct v1.10.0 image the
+  package is legitimately absent, the assertion's `if [ -z "$sites" ]; then exit
+  1` fired, and run 704 ended **100 passed / 1 failed** on `smoke` and **103
+  passed / 1 failed** on `smoke-studio` — same single assertion, every
+  studio-specific check green. `build-variant`, `build-variant-studio`,
+  `promote-base-latest` and `update-description` were all skipped, so **nothing
+  was published**: the gate behaved exactly as designed, against a stale
+  expectation rather than a real defect.
+
+  The fix does not delete the guard, because the guard was right: "fail when the
+  family is absent" is what stops `prune_foreign_natives()` from silently
+  deleting the binding instead of the surplus platform copies. It now **derives
+  its expectation from what the image's pi actually declares** — if pi declares
+  the dependency an install must exist and load; if pi does not, no install may
+  linger. That re-arms by itself should a future pi re-add it, and it still
+  catches an orphaned install. Verified as a four-quadrant truth table with the
+  command string extracted verbatim from the file and run through `sh -c` the way
+  `run()` invokes it: declared+present → rc=0, declared+absent → rc=1,
+  undeclared+absent → rc=0, undeclared+present → rc=1.
+
+  Worth stating plainly, since it is the whole value of the round: pi 1.0.0,
+  pi-atelier v0.13.0 and pi-studio v0.9.61 passed **103 of 104** assertions on a
+  pi MAJOR bump. The one red was the suite describing pi 0.85.1's dependency
+  graph, not the image.
+
+---
+
+## v1.10.0 — 2026-10-02 (tagged, never published — superseded by v1.10.1)
+
+> Tagged 2026-10-02 at commit `12f99c4`. Its build (run 704) went red on the
+> stale clipboard assertion described under v1.10.1, so `build-variant`,
+> `build-variant-studio`, `promote-base-latest` and `update-description` all
+> skipped and nothing reached the Hub. No image carries this tag. The content
+> below is accurate and shipped as **v1.10.1**.
 
 Three small fixes found by the v1.9.4 first-boot acceptance and the CI base
 hash prediction, plus one boot-time wiring fix that stops a recurring `git push`
@@ -209,38 +264,6 @@ jump, four new base packages and a new mailbox feature. The release carrying a
 
 ### Fixed
 
-- **The smoke suite asserted a pi dependency that upstream deleted, and it cost
-  this release its first tag build** — `scripts/smoke-test.sh` required
-  `@mariozechner/clipboard` to be installed and `require()`-able at every install
-  site. pi **0.86.0** (`#9163`) *"Replaced the external native clipboard
-  dependency with bundled asynchronous macOS, Windows, and X11 helpers while
-  preserving platform command and OSC 52 fallbacks"*. Measured in the published
-  tarballs: pi `0.85.1` declares `@mariozechner/clipboard@0.3.9`; `0.87.1` and
-  `1.0.0` declare no `@mariozechner/*` at all. So on a correct v1.10.0 image the
-  package is legitimately absent, the assertion's `if [ -z "$sites" ]; then exit
-  1` fired, and run 704 ended **100 passed / 1 failed** on `smoke` and **103
-  passed / 1 failed** on `smoke-studio` — same single assertion, every
-  studio-specific check green. `build-variant`, `build-variant-studio`,
-  `promote-base-latest` and `update-description` were all skipped, so **nothing
-  was published**: the gate behaved exactly as designed, against a stale
-  expectation rather than a real defect.
-
-  The fix does not delete the guard, because the guard was right: "fail when the
-  family is absent" is what stops `prune_foreign_natives()` from silently
-  deleting the binding instead of the surplus platform copies. It now **derives
-  its expectation from what the image's pi actually declares** — if pi declares
-  the dependency an install must exist and load; if pi does not, no install may
-  linger. That re-arms by itself should a future pi re-add it, and it still
-  catches an orphaned install. Verified as a four-quadrant truth table with the
-  command string extracted verbatim from the file and run through `sh -c` the way
-  `run()` invokes it: declared+present → rc=0, declared+absent → rc=1,
-  undeclared+absent → rc=0, undeclared+present → rc=1.
-
-  Worth stating plainly, since it is the whole value of the round: pi 1.0.0,
-  pi-atelier v0.13.0 and pi-studio v0.9.61 passed **103 of 104** assertions on a
-  pi MAJOR bump. The one red was the suite describing pi 0.85.1's dependency
-  graph, not the image.
-
 - **`git push` from inside the container dies on a read-only ControlPath, and no
   amount of documentation was fixing it** — `entrypoint-user.sh` now sets
   `core.sshCommand` to `ssh -F $HOME/.ssh-local/config` when that sidecar exists.