v0.10.0 — TOML config, reusable variables, and a complete Docker runner
## Highlights
- **TOML configuration** — write `bam.toml` instead of `bam.yaml`; the formats
are fully equivalent. `bam --init --format toml` scaffolds one.
- **Reusable variables** — a `vars` section with `{{name}}` references and
`env_var()` / `env_var_or_default()` lookups, in the style of `just`.
- **Docker runner completed** — volumes, env forwarding, opt-in host env
passthrough, host user mapping, resource limits, network isolation, private
registry authentication, pre-flight image pulls and container cleanup.
- **`bam --clean-outputs`** — delete the files tasks declare as outputs; no
hand-written clean target to keep in sync.
## Breaking
- Docker tasks now run as the invoking user rather than root. Images that need
root must set `runner.user: root`.
- `--invalidate-cache` requires a task argument; use `--clean-cache` to clear
everything.
- `--clean` / `--clean-force` are deprecated aliases for `--clean-cache` /
`--clean-cache-force`.
## Notable fixes
- Task output containing square brackets no longer crashes bam.
- Docker tasks no longer silently defeat the cache via root-owned outputs.
- `--clean-cache` now respects the cache path from your config.
See CHANGELOG.md for the full list of changes.