v0.36.0 — the external-report release

The external-report release. An adopter ran Proximo end to end and reported three findings. Two were shipped mechanisms an adopter could not see; one was a gap the default door made plain: a client's permission policy could not tell a status read from a power cycle. This release is the fixes plus everything they pointed at.

New

• proximo_read — the enforced read-only door. In the default lean mode every call rides proximo_call, whose only honest static hint is readOnlyHint: false (annotations ride tools/list; a hint cannot vary per dispatched call). proximo_read(tool, arguments) is the hatch's read-only twin: same reach, same single dispatch funnel, readOnlyHint: true — and the hint is an enforced promise, not a label. The verdict derives from the same READ-ONLY:/MUTATION: marker that emits every hint, so promise and enforcement cannot diverge; a mutating tool, an unmarked tool, and proximo_call itself refuse before dispatch, fail-closed.
• The facade carries readOnlyHints. proximo_find_tools and proximo_tool_schema say true (local catalog reads); proximo_call honestly says false. 33 read tools gained their missing READ-ONLY: marker (each body verified a pure read first), and a gate now pins the unmarked set to exactly the two tools that defy the binary.
• Two new off-box audit-anchor sinks. http (PROXIMO_AUDIT_ANCHOR_SINK=http + PROXIMO_AUDIT_ANCHOR_URL): GET/PUT one pin resource on a receiver on a different host — TLS verification has no off switch on this channel by design, redirects are refused as the tamper signal they are, bearer token by file reference. syslog (PROXIMO_AUDIT_ANCHOR_SYSLOG_ADDRESS): the write-only witness — every clean audit_verify appends the head to a collector's append-only trail; it declares fetches_pins: false honestly, and UDP is refused by design (a publish that cannot fail is not a check).
• The anchor is discoverable from the tool itself. audit_verify's unpinned nudge now names the automated anchor (PROXIMO_AUDIT_ANCHOR_SINK=file), not just the manual env pin — the mechanism shipped in 0.13.0; now its own output says so.
• Daily fresh-resolve smoke of the published wheel (pypi-smoke.yml): installs whatever PyPI calls latest into a clean venv on both supported mcp majors — the exact path a bare uvx proximo-proxmox takes — and cold-starts it. A dependency release that breaks fresh adopter installs now trips our CI, not your first run.

Measured

Doorway figures re-measured across the board: the default door is ~1,740 tokens (one new resident tool plus accumulated description growth the pins had absorbed in-band), MEMORY=0 ~1,166, full surface ~289,839. Tool estate unchanged at 906.

Full detail, including every honesty note, in CHANGELOG.md.