chore(release): v0.36.0

[avrabe]

What

Release bump for v0.36.0, cutting the fuzz-target guardrail fix shipped in #409 (merged to main as d68fed5).

• [workspace.package] version in Cargo.toml: 0.35.0 → 0.36.0
• Cargo.lock: all 23 workspace crates rebumped via cargo update --workspace (no third-party dependency versions changed — 79 unchanged)
• vscode-spar/package.json: 0.35.0 → 0.36.0
• REQ-GUARD-FUZZ-SMOKE-001: implemented → verified, release: v0.36.0

Why

#409 taught tools/check_fuzz_targets.py to audit the required fuzz-smoke context's target list (ci.yml) rather than only the advisory nightly matrix — closing the list-parity hole #406 named. This release records that requirement as verified and ships it.

The status flip stays within the guardrail's {implemented, verified, accepted} claiming set, so no new verification-filter enforcement is introduced; the linked TEST-GUARD-FUZZ-SMOKE steps already passed green on #409.

Scope

Version/lockfile/artifact metadata only — no source changes. All feature code and its oracles landed and passed full CI (incl. Mutation Testing + Lean) on #409 before merge.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[avrabe]

Merged — v0.36.0 STAGED on main (686a23a); needs a maintainer tag push.

All required checks passed on this PR (Mutation Testing ran ~2h and went green) and it's merged. The signed tag push is blocked: git push origin v0.36.0 returns HTTP 403 Forbidden from GitHub's git-receive-pack (a v* tag-protection ruleset — branch pushes from the same identity succeed, and the proxy relayed cleanly). release.yml has not triggered.

To finish, please push the signed tag from your local:

git fetch origin main
git tag -s v0.36.0 686a23a -m 'spar v0.36.0'
git push origin v0.36.0

Full context and the honest signing note are on #406.

---

Generated by Claude Code