jevnav v0.1.10

jevnav 0.1.10 — the reorder signal gets the right ground truth.

moved compared the package version, so a trace recorded by 0.1.8 and replayed
by 0.1.9 — identical ordering code — was excused as "re-ranked" while the page
had really reordered. With a release a day, that excused almost every real
reorder. The signal is now page.ORDER_SPEC, bumped only when the shortlist
ordering (ROLE_RANK, global_order, the cap) changes, recorded in every trace as
run.order_spec. Older traces map their tool version onto it (0.1.0 → 0,
0.1.1–0.1.4 → 1, 0.1.5+ → 2); an unknown ordering never excuses movement.

The pytest plugin's secret pattern is anchored on token boundaries:
COMPASS_DIR, MONKEY_PATCH_DIR, KEYCHAIN_PATH, PASSENGER_ROOT,
AUTHOR_NAME and BYPASS_CACHE no longer look like secrets (their values were
being rewritten to value_from_env and replayed as another machine's value),
while PASSWORD123 still does.

213 tests (212 pass, 1 skip).