Release v4.35.0

Added

• MCP can propose a fix for a diagnostic: read-workspace has a repairs view listing the compiler-authored repairs for the workspace's diagnostics (code, subject and typed operations), and propose-repair turns one into a retained proposal. Review it with read-proposal and write it with apply; nothing is written before that, and a stale workspace revision is refused with a typed conflict.
• The first repair migrates a deprecated validate csharp block (PLAY0397) to a tagged ```csharp fence. The code body, its requirement identity and content hash, and the executable model are unchanged. The repair reprints the whole file canonically, so it is refused if that would drop a comment. Other PLAY0397 forms are not offered a repair.
• Library hosts can find and propose repairs through WorkspaceDiagnosticRepairs.Find and ProposeRepair, which require canonical formatting (RequiredFormatting).
• Adding a node whose references don't resolve is refused under the safe reference policy, which is how decision 0014 covers "link" in #138.