Record the 0.10.0-rc.1 candidate build

TODO.md

@@ -62,9 +62,14 @@ verify every distribution path. This is the next minor release after the 0.9.x p
       may land after the freeze. (Frozen 2026-11-03 after the 0.9.6 integration
       checkpoint; this pass is limited to release reliability, accessibility,
       balance evidence and packaging.)
-- [-] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
-      accessibility settings and checkpoint/resume enabled. (claimed; building
-      `0.10.0-rc.1` from a clean worktree)
+- [x] Produce a release-candidate build with the tutorial, campaign, all three venues, Help,
+      accessibility settings and checkpoint/resume enabled. (Clean worktree
+      `a9658ec` built `0.10.0-rc.1`: Linux 161.5 MB, Windows 197.2 MB, macOS
+      148.0 MB, Web 97.8 MB and HQ 241.6 MB. The Web/HQ archives include the
+      credits, privacy, accessibility and known-limitations pages; SHA-256
+      manifests were written; the Linux and HQ binaries launched headless and the
+      Web index/wasm/pck/docs returned HTTP 200. Not published because external
+      playtest and legal approval remain open.)
 - [ ] Run at least five first-time-player sessions covering the tutorial and one full venue shift;
       record where players get stuck, misunderstand evidence or choose disproportionate escalation.
 - [ ] Triage findings by severity (P0/P1/P2) and fix every P0/P1 onboarding/accessibility issue;
@@ -115,10 +120,15 @@ verify every distribution path. This is the next minor release after the 0.9.x p
 
 ### Release engineering and distribution
 
-- [ ] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
-      artifact names, sizes and checksums.
+- [x] Run `tools/build_releases.sh` from a clean checkout and verify Linux/Windows/macOS/Web/HQ
+      artifact names, sizes and checksums. (Clean worktree `a9658ec` built the
+      five artifacts listed above; `PUBLISH_DRY_RUN=1` produced and printed
+      `build/SHA256SUMS-0.10.0-rc.1.txt` without touching the API.)
 - [ ] Smoke-test fresh Linux portable/AppImage, Windows portable/installer, macOS unzip/launch,
       Web static hosting and Desktop HQ Vulkan fallback on the target matrix.
+      (Linux portable and Desktop HQ launched headless; Web files served over a
+      local static server with HTTP 200. AppImage/installer were not built locally
+      and Windows/macOS launch testing still needs the target matrix.)
 - [x] Add a disk-space preflight and retention policy to the release/publish scripts so a full
       Gitea host cannot leave a partially uploaded release. (`publish_release.sh`
       checks artifact size/free space, writes SHA-256 checksums, supports