v0.35.67

spawn: keep durable workspaces off dirty main

Carries kai-cli #84. Tagged by hand because kai-cli publishes only on a
tag push (ci.yml gates its release steps on refs/tags/), and no engine
release has fanned out since this merged — so without this the change
sits on main and reaches no client.