chore: adopt shared CI 0.10.0

[rldyourmnd]

Scope

Advance all seven reusable-workflow callers and the workflow provenance README from immutable shared-CI 0.8.1 to signed release 0.10.0.

Compatibility audit found no changed or newly required inputs, no permissions-ceiling changes, and no new consumer files or steps. The ZCode runtime bundle is already a strict subset of the source archive required by 0.10.0.

Validation

• shared workflow_call interface comparison passed
• release runtime paths subset proof passed: 81 of 109 archive entries, no outside paths
• actionlint passed for all workflows
• zizmor offline pedantic passed with no findings
• git diff --check passed
• No setup, JSON, installer, secret, or development-only artifact changed

Release

• No ZCode runtime or build behavior changed; build and core-plugin versions remain unchanged
• Workflow provenance documentation matches the immutable pin