Prepare bb-app 0.36.0

[SawyerHood]

Summary

Prepares the 0.36.0 release: version lockstep bump and release notes.

• bump bb-app and @bb/desktop to 0.36.0 via scripts/bump-version.mjs
• add the 0.36.0 section to CHANGELOG.md
• add the 0.36.0 entry to RELEASE_META in apps/web/src/landing/changelog.ts

Release notes

Headline is "Fixes and improvements". The notes lead with the loopback bind default (#1125), because it is the one change that needs user action before the upgrade. That section links to docs/multiple-devices.md for the bb connect and Tailscale Serve setup steps rather than repeating them.

Two risks are called out explicitly in the notes:

• The host daemon protocol moved 69 → 82 in this range. A remote daemon that reaches the server at a direct host:38886 address loses its route and cannot self-update, so the route must move first.
• A thread that names no model now resolves one from the provider catalog on the target host (Resolve default models from provider catalogs #1002), and fails to start when that host cannot list models.

A Thanks section credits the external contributors in this range: @ben-vargas, @Diffuzmetall, @kschrader, and @toasterman234.

Commands stay as inline code spans throughout. The /changelog parser handles only paragraphs and bullets, and its inline renderer supports only code and strong, so a fenced block or a Markdown link would render as literal text on the marketing site.

Validation

• node .github/workflows/check-version-lockstep.mjs — bb-app=0.36.0 @bb/desktop=0.36.0
• pnpm exec turbo run typecheck test --filter=@bb/config --filter=@bb/server --filter=bb-app --force — 1367 tests passed
• pnpm exec turbo run smoke:tarball --filter=bb-app --force — passed
• git diff --check — clean

Unrelated pre-existing issue found while validating: apps/server/test/internal/internal-skill-trees.test.ts asserts a file mode of 0o644, which depends on the process umask. It fails under umask 002 and passes under umask 022. CI is unaffected.

Follow-ups

• Redeploy @bb/web after this lands so /changelog shows 0.36.0.
• publish-bb-app.yml and build-desktop.yml still need to run from main at this commit.

🤖 Generated with Claude Code

[SawyerHood]

🚨 SLOP COP 🚨 · review

I am the Slop Cop. I am reviewing this pull request under the security, quality, performance, architecture, and end-to-end guidelines.

[SawyerHood]

🚨 slopcop/review — The migration guide URL renders as plain text on /changelog.

This release note tells affected users to complete a required route migration. The browser test confirmed that the article contains no link for this URL. ChangelogInline supports only text, code, and strong text, so the browser cannot create an anchor. Please add safe link support and render these setup steps as a link.

[SawyerHood]

🚨 SLOP COP 🚨 · review

ELI5: This pull request prepares version 0.36.0 and adds its release notes. The version work is correct, but one important setup link does not work.

I found one concrete issue. The loopback migration guide appears as plain text on /changelog. Affected users cannot select it as a link. I left an inline comment with the required fix.

The security review found no new vulnerability. The change adds static release data and keeps React text escaping in place.

The end-to-end test passed. /changelog showed 0.36.0 first, the anchor worked, the homepage showed the new headline, and the browser reported no errors.

The parser completed in 0.27 ms. This release adds about 1.7 KB gzip to a shared marketing bundle because all routes include the full changelog. That architecture existed before this pull request. A later change should load the full changelog only for its route.

The repository scan found no stale release version and no duplicate release prose. The two package versions match, and the release metadata has its intended separate role.

All CI and package smoke checks pass. I used a comment-only review, as required.