v0.10.0: Tessera v1.0 compat (RustProvenanceLabelAdapter)

Requires tessera-mesh>=1.0.0 (Tessera GA), specifically v1.0.2 or later, which ships the missing tessera_rs.label submodule shim.

Added

• RustProvenanceLabelAdapter in agentmesh.adapters.tessera_rs that wraps the v1.0 tessera_rs.label.ProvenanceLabel PyO3 binding (Wave 4B in the Tessera v0.12-to-v1.0 plan). Ships four surfaces: trusted_user, untrusted_tool_output, join, and to_canonical_json plus three numeric accessors (integrity_numeric, secrecy_numeric, capacity_numeric).
• _TesseraRsBundle.label and _TesseraRsBundle.label_available flag for AgentMesh callers that want to gate the fast path on the v1.0 wheel being installed.
• Five parity tests in tests/test_tessera_rs_adapter.py covering trusted-user / untrusted-tool-output construction, the max-integrity join law, canonical-JSON source preservation, the Python-fallback path for non-default secrecy, and the mixed-backend join rejection.

Changed

• tessera-mesh dependency pin raised to >=1.0.0 so users get the v1.0 GA library by default. Older tessera-mesh>=0.7.1 installs still work; RustProvenanceLabelAdapter falls back to Python when the tessera_rs.label submodule is absent.
• agentmesh-proxy /healthz version field now reports 0.10.0 (was stuck at 0.7.1 since v0.7.1).
• FastAPI app version raised from 0.3.0 to 0.10.0.

Verified

• pytest tests/test_tessera_rs_adapter.py -v passes 5 new label tests + the existing parity matrix when tessera-rs>=1.0.0 is installed; the label tests skip cleanly on older wheels.
• Full AgentMesh suite: 267 passed, 10 skipped.