v3.5.0

What's Changed

• Use official Homebrew and release distribution paths by @Abdel-RahmanSaied in #68
• fix: gate public namespace and decision claims by @Abdel-RahmanSaied in #69
• release: publish official GitHub App container by @Abdel-RahmanSaied in #70
• docs: establish managed CI Phase 0 contracts by @Abdel-RahmanSaied in #71
• feat(contracts): managed-ci v2 evidence facts and finding-policy parity (ADR-010 C5/C6) by @Abdel-RahmanSaied in #74
• fix(contracts): accept the producer's fingerprint at its real width by @Abdel-RahmanSaied in #76
• feat(managed-ci): export v2 evidence facts from the engine (Phase 2A) by @Abdel-RahmanSaied in #75
• docs(managed-ci): signed engine build record schema and threat model by @Abdel-RahmanSaied in #78
• feat(managed-ci): Action managed mode and submission transport (Phase 2B) by @Abdel-RahmanSaied in #77
• feat(managed-ci): produce and sign a build record for every release by @Abdel-RahmanSaied in #79
• fix(release): build release binaries with Go 1.27.1 so govulncheck loads Go 1.26+ code by @Abdel-RahmanSaied in #81
• fix(managed-ci): name a contract-ceiling refusal as the terminal error by @Abdel-RahmanSaied in #82
• test(managed-ci): pin why a managed run's local report never shows BLOCK by @Abdel-RahmanSaied in #83
• fix(cli): enforce --fail-on in any case, and label the managed local summary by @Abdel-RahmanSaied in #84
• docs: publish executable engine reference contracts by @Abdel-RahmanSaied in #85
• chore(release): roll CHANGELOG and reference contracts to v3.5.0 by @Abdel-RahmanSaied in #86

Full Changelog: v3.4.1...v3.5.0