docs(release): the 1.10.4 record

docs/releases/1.10.4.md

@@ -0,0 +1,32 @@
+# Kept 1.10.4
+
+Built 2026-10-16 from commit `35b1144bd96dd29b20760da89d497d6c6fe6b712` by `scripts/release.sh` on GitHub Actions (https://github.com/keptinventory/kept/actions/runs/38907763917).
+
+## The image
+
+`ghcr.io/keptinventory/kept@sha256:a9d4397eb6583e9edd8169ef950e784fca097e3378753164620528111e6f8ce5`, for linux/amd64 and linux/arm64, each smoked by digest before any tag
+(each natively, by the workflow's build job on a runner of its own architecture) with `/version` answering 1.10.4 at this commit.
+
+| Platform | Manifest |
+|---|---|
+| linux/amd64 | `sha256:c0a243f3691bfa96ce8a084809f8de64804aed601da0e617d2e66a2da2a3f89c` |
+| linux/arm64 | `sha256:72ed400f675c509aee75740e82c17809cc0d532fc525979e4143b12fc564d7ea` |
+
+Tags, all pointing at that digest (there is never a `latest`):
+
+- `ghcr.io/keptinventory/kept:1.10.4`
+- `ghcr.io/keptinventory/kept:1.10`
+- `ghcr.io/keptinventory/kept:1`
+
+## The chart
+
+`oci://ghcr.io/keptinventory/charts/kept:1.10.4` (`sha256:4cc2297c3bf7a694be69752972063328e391241bbac0ef2563b1d686256db017`), appVersion 1.10.4, its image pinned by the digest above.
+
+## Verify
+
+```sh
+cosign verify --key cosign.pub ghcr.io/keptinventory/kept:1.10.4
+cosign verify --key cosign.pub ghcr.io/keptinventory/charts/kept@sha256:4cc2297c3bf7a694be69752972063328e391241bbac0ef2563b1d686256db017
+docker buildx imagetools inspect ghcr.io/keptinventory/kept:1.10.4 --format '{{ json .SBOM }}'   # the SPDX SBOM per platform
+```
+