v3.35.5

Docs: the Boost guideline and skill (copied into host apps on composer update), the README and CLAUDE.md now say that a public $filters passed to filter() is untrusted and how to allow-list it: filter(Arr::only($this->filters, [...])). They also cover what filter() refuses since 3.35.4, the $visible footgun, and list semantics on plain vs JSON columns.

Correction to the v3.35.4 notes: do not mark a $filters that atom's table controls bind to as #[Locked]. Livewire refuses every client update to a locked property, so search, filter selects and chips stop working. (#97)