fix(release): update stale Play whatsnew to 0.4.10; correct runbook (#128)

The Play publish workflow uses distribution/whatsnew/whatsnew-en-US (its
whatsNewDirectory), NOT the fastlane changelogs/*.txt (those feed F-Droid).
That file was stale at v0.4.7 — so 0.4.8/0.4.9/0.4.10 all shipped to the
internal track with outdated release notes. Updated it to 0.4.10 (<500 chars).

Also corrected PUBLISHING.md, which I'd previously written wrong: (a) app.json
android.versionCode is overridden by CI (github.run_number+100), so 0.4.10's
real Play versionCode is 142, not the app.json value — hand-bumping it is
pointless for Play; (b) Play release notes live in distribution/whatsnew, not
fastlane changelogs. Discovered while promoting 0.4.10 (the Console showed
versionCode 142, not the app.json 37).


Claude-Session: https://claude.ai/code/session_01T12AhSnQVrSxNnvwfCx2z6

Co-authored-by: engineer <engineer@macbookpro.lan>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

distribution/whatsnew/whatsnew-en-US

@@ -1,3 +1,3 @@
-v0.4.7 — Reconnecting banner + push notifications for approvals
+v0.4.10 — Try it instantly, plus reliability & security fixes
 
-See a live status banner when your server connection drops ("Reconnecting...") and a confirmation when it recovers. Agent approval requests and questions now send an OS push notification when the app is in the background. Privacy improvements: URL credential scrubbing is now covered by automated tests.
+New: tap "Try a demo" to see OpenCode in action with no server needed. Clearer setup explaining the app connects to a computer running "opencode serve". Security: "Require Biometric to Open" now re-locks whenever the app is backgrounded, and editing a connection's password now saves. Plus more reliable notifications and fixes for disappearing messages, the session view, and a stuck spinner after a network drop.