release: v0.10.0 — the exploit-verification release

Bumps 0.9.14 -> 0.10.0 (skeletonkey.c, README, docs/index.html) and prepends
v0.10.0 release notes.

Milestone: the corpus moved from detect-verified to out-of-band exploit-verified.
11 modules confirmed landing uid=0 in a VM (witnessed independently, never
self-reported); four modules that falsely reported EXPLOIT_OK without ever
getting root were fixed (pwnkit, ptrace_traceme, dirty_pipe, dirty_cow); a
full false-EXPLOIT_OK audit was closed (every success claim now backed by a real
out-of-band check). New/rewritten working exploits: ptrace_traceme, sudo_samedit,
overlayfs_setuid (libfuse), dirty_pipe, dirty_cow. Plus fixes to a systemic
userns uid_map bug, the kptr_restrict offset resolver, a su-over-pty hang, a
readback buffer overflow, and an old-header portability issue; overlayfs upgraded
to a direct uid=0 witness.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

README.md

@@ -214,8 +214,16 @@ also compile (modules with Linux-only headers stub out gracefully).
 
 ## Status
 
-**v0.9.14 cut 2026-07-23.** 46 modules across 41 CVEs — **every
-year 2016 → 2026 now covered**. Newest: `refluxfs` (CVE-2026-64600,
+**v0.10.0 cut 2026-07-24 — the exploit-verification release.** The corpus
+moved from *detect*-verified to **out-of-band exploit-verified**: **11 modules
+now confirmed landing `uid=0` in a VM**, each witnessed independently (a
+root-owned artifact / `/etc/shadow` read / setuid-bash sentinel) rather than
+self-reported. Along the way, **four modules that falsely reported `EXPLOIT_OK`
+without ever getting root were fixed** (`pwnkit`, `ptrace_traceme`, `dirty_pipe`,
+`dirty_cow`), and a full false-`EXPLOIT_OK` audit was closed — every success
+claim is now backed by a real out-of-band check. See `docs/EXPLOITED.md`.
+46 modules across 41 CVEs — **every year 2016 → 2026 now covered**. Newest
+module: `refluxfs` (CVE-2026-64600,
 Qualys TRU's "RefluXFS" — a nine-year TOCTOU race in the XFS **reflink
 copy-on-write** path: `xfs_reflink_fill_cow_hole()` drops `ILOCK` to wait
 for transaction log space, then re-checks the refcount btree at a