0.35.1

Fixed

• An unknown instance is answered by the command's declared not-found outcome, not its
  wrong_state outcome. Since 0.34 synthesis sent a fresh identity to a command declaring both
  (not-found and wrong-state) and required wrong-state, so an implementation
  answering the outcome its own specification declares for a missing record failed. A not-found
  outcome is an external: refusal without input guard whose error: carries a field of the
  identity's type; its scenario now sends the fresh identity instead of injecting the cause, and
  the command gets no …/outcome/wrong-state scenario. A command declaring no such outcome keeps
  the 0.34 rule; one declaring two gets a note: and neither is assumed. No format change.

• ess verify bindings --live --observation-out and cargo xtask infra-acceptance --scratch no
  longer take a .git directory Git cannot open (one holding only info/exclude, as a harness
  leaves in a directory that is no repository) for a checkout. A .git directory holding HEAD,
  objects, refs or commondir, a .git file, a .git symlink and an unreadable marker are
  still refused. Both guards share one rule; the xtask check previously also refused an empty
  .git directory and admitted an unreadable one.

• cargo xtask docs reads every phrasing the published documents have used for an unreleased
  format — "not yet released", "not released", "next release", "upcoming" and "not yet shipped"
  as well as "unreleased" — where it read only the last, and missed ess/13 called "not yet
  released" after 0.35.0 shipped it. A bare /N counts for the family named before it on the line,
  as the revised-envelope table writes ess-scenario/ and /3. It tracks the release of every
  family the version history gives one (ess-scenario, ess-normalization, the revised
  envelopes and infra-* besides ess, ess-diff and ess-conformance), and refuses a family
  the history gives a release that it does not track.

• The two ess-xtask regressions that execute the schema-metadata guard no longer fail when the
  caller sets CARGO_TARGET_DIR, a job count, a debug profile or a compiler wrapper: they decide
  over controlled build and process facts, and one now asserts that the same authority refuses each
  of the four. Production qualification still reads this build and this process and refuses
  exactly what it refused.