v0.10.0

Changelog

• 531e062 Merge remote-tracking branch 'origin/main' into feat/browser-login-cmd
• 00af1d0 Merge remote-tracking branch 'origin/main' into feat/browser-login-cmd
• 98a0dad Merge remote-tracking branch 'origin/main' into feat/browser-login-cmd
• 50ddf5f Merge remote-tracking branch 'origin/main' into feat/browser-login-config
• 5427e7d Merge remote-tracking branch 'origin/main' into feat/browser-login-config
• 54c5fbc Merge remote-tracking branch 'origin/main' into feat/browser-login-exchange
• 6f4bf00 Merge remote-tracking branch 'origin/main' into feat/browser-login-run
• dd367ea Merge remote-tracking branch 'origin/main' into feat/browser-login-run
• 8107348 chore(release): prepare v0.10.0
• d1e930a ci(release): pass SEPTIEMBRE_COGNITO_CLIENT_ID to goreleaser
• 30aab52 docs(auth): add Cognito app-client provisioning guide for browser login
• 935fbd1 feat(authflow): add Cognito token exchange for browser login
• 792445a feat(authflow): add PKCE and CSRF-state primitives for browser login
• 0b0ab10 feat(authflow): add Run orchestrator for browser login
• aa97b52 feat(authflow): add loopback callback server for browser login
• e42656c feat(authflow): add per-OS browser opener abstraction for browser login
• d2dfe54 feat(cli): add septiembre login command
• b2867af feat(credentials): add Cognito config resolution (domain, client ID)
• ba3cd80 fix(authflow): make one-shot 410 test deterministic
• 40407e1 fix(authflow): satisfy errcheck and staticcheck in Run and its tests
• 21bacc4 fix(authflow): satisfy errcheck on response write and test cleanups
• 501c458 fix(authflow): satisfy errcheck on test connection closes
• 3deaef9 fix(cli): use fmt.Fprintf in login test stubs per staticcheck
• 38e3821 test(authflow): add concurrent one-shot and error_description leak coverage to loopback server
• 34c1aeb test(authflow): assert code-leak and verifier-leak on all Run subtests
• 818e938 test(authflow): hard-fail the concurrent callback invariant immediately
• 02fcc66 test(authflow): pin code_challenge_method=S256 in authorize URL
• a07df37 test(authflow): pin defaultBrowserOpener constructor contract
• b50004f test(cli): cover septiembre login command end to end
• 3d6cd15 test(credentials): pin http:// passthrough for Cognito domain