v0.10.0

Content conservation check: preen now records the full content tree before it
touches anything and verifies at the end that committed plus still-uncommitted
content is unchanged, so a run that lost or invented a change is caught instead
of trusted. The only allowed differences are paths a sweep or drop removed or a
commit hook reformatted. On a mismatch, preen stops and restores from the
backup ref.

The eval harness asserts conservation on every case: the content tree (HEAD
plus all uncommitted changes) must be identical before and after the run.