docs(release): the 1.10.3 record

docs/releases/1.10.3.md

@@ -0,0 +1,32 @@
+# Kept 1.10.3
+
+Built 2026-10-16 from commit `5dd9dda5f8f9c50858286ab1f128c77d3bc11694` by `scripts/release.sh` on GitHub Actions (https://github.com/keptinventory/kept/actions/runs/38844374310).
+
+## The image
+
+`ghcr.io/keptinventory/kept@sha256:6ca5b2febaee3d83ccdc77d9f22c52eb8e7ef3ffa07fa7bfd1e30dbf448fed94`, for linux/amd64 and linux/arm64, each smoked by digest before any tag
+(each natively, by the workflow's build job on a runner of its own architecture) with `/version` answering 1.10.3 at this commit.
+
+| Platform | Manifest |
+|---|---|
+| linux/amd64 | `sha256:ffaa09df241a3ffbb29ab77e21c3eb3e9bb5e20ce9e1aa819a15b6f43c55ed8d` |
+| linux/arm64 | `sha256:18366a10f8012b1b502b59cf26efc3cdc8c32f99ff065f6fca8f30a44eb48c33` |
+
+Tags, all pointing at that digest (there is never a `latest`):
+
+- `ghcr.io/keptinventory/kept:1.10.3`
+- `ghcr.io/keptinventory/kept:1.10`
+- `ghcr.io/keptinventory/kept:1`
+
+## The chart
+
+`oci://ghcr.io/keptinventory/charts/kept:1.10.3` (`sha256:9a185f095d20ea508e1994c88e0a0c2f3120e21bd238030e7d482338364fa97f`), appVersion 1.10.3, its image pinned by the digest above.
+
+## Verify
+
+```sh
+cosign verify --key cosign.pub ghcr.io/keptinventory/kept:1.10.3
+cosign verify --key cosign.pub ghcr.io/keptinventory/charts/kept@sha256:9a185f095d20ea508e1994c88e0a0c2f3120e21bd238030e7d482338364fa97f
+docker buildx imagetools inspect ghcr.io/keptinventory/kept:1.10.3 --format '{{ json .SBOM }}'   # the SPDX SBOM per platform
+```
+