v3.6.0

Changelog

• 1c2efcc build(go): move the Go toolchain to 1.26.10 (#2110)
• 20d07b7 feat(ci): add non-required vulnerability and workflow checks (#2102)
• ac07f6f feat(ci): consume canonical proof configuration in fork CI (#2064)
• d2c4bd3 feat(ci): isolate superseded PR verification (#2104)
• c4ff11a feat(release): admit reviewed staged artifact inputs (#2067)
• 171bfda fix(claude-code): preserve LF project responses on Windows (#2093)
• f4e11b5 fix(cli): compare only plain release versions for updates (#2090)
• 73ad960 fix(deps): bump golang.org/x/text to v0.41.0 for GO-2026-6629 (#2109)
• aab0bb7 fix(deps): bump jackc/pgx/v5 to v5.9.2 for GO-2026-5004 (#2108)
• 5165049 fix(obsidian): reject unsupported export limits (#2074)
• aec0f4f fix(plugin): isolate Claude Pi guard fixtures from ancestor Git (#2092)
• fcd9301 fix(plugin): wait for Codex stdin probe publication (#2094)
• 4a605c1 fix(plugin): wait for Codex stdin probe readiness (#2099)
• bdabea2 fix(relations): hide unjudgeable cross-project pending pairs (#2081)
• b5c0365 fix(setup): preserve Codex TOML during legacy cleanup (#2088)
• 16e06bb fix(store): report incomplete candidate persistence (#2087)
• 7634092 fix(tests): isolate project fixtures and preserve contract LF (#2084)
• 233bc04 fix(tests): isolate sync default project from process override (#2085)
• 5af068f fix(tests): preserve Windows startup lock fixture checks (#2073)
• 3e06420 fix(tests): respect runtime directory in SQLite HTTP fixture (#2086)
• 2f4e0bd perf(sync): reuse decoded pending chunks across local import classification and apply (#1845)
• 98912f8 test(ci): refresh workflow baseline after Go 1.26 update (#2111)