v0.35.0

• Fail closed on a _url value that is not a clean URL but contains ://, so a secret behind a BOM, zero-width space, control character, or label no longer leaks
• Keep CRLF line endings on dotenv and TOML edits; dotenv no longer doubles a key's first character on CRLF files
• Write a TOML string containing a newline as a single-line escaped string, so the stored value is the one set
• Cap CLI document file reads at 16 MiB by default, adjustable with --max-file-bytes on every document command and lint
• Use one explicit grammar for YAML numeric-key quoting, Plain quoting, and _url whitespace across Rust, Go, Python, and TypeScript
• Send render output where --output-to says
• Exit 0 when the stdout reader closes early, in the Rust CLI and the Python and TypeScript emitters
• Upgrade noyalib to 0.0.53