MPC 3.6.0

This release adds support for starknet logs in foreign transaction verification requests, along with a few security improvements and bug fixes.

What's Changed

#2199(@DSharifi): Add new collection type, BoundedVec, to the bounded collections crate (#2199)
#2132(@barakeinav1): Allow passing mpc_ env variables (#2132)
#2202(@DSharifi): Create near-mpc-sdk crate with types for sign requests (#2202)
#2218(@DSharifi): (sdk) The SDK can build foreign chain requests for bitcoin (#2218)
#2222(@DSharifi): (sdk) The SDK can build foreign chain requests for abstract (#2222)
#2224(@DSharifi): (sdk) The SDK can build foreign chain requests for starknet (#2224)
#2233(@DSharifi): (sdk) Add verification support of foreign transaction signatures (#2233)
#2254(@DSharifi): (sdk) Chain-specific builder entry points for foreign chain request builder (#2254)
#2258(@olga24912): Add StarkNet event log extraction support (#2258)
#2266(@DSharifi): (sdk) Add borsh serialization derives to all contract interface types and SDK verifier (#2266)
#2265(@DSharifi): (sdk) Verify foreign transaction payload signatures (#2265)
#2281(@gilcu3): Added support for abi generation in mpc-sdk and signature-verifier crate (#2281)

#2237(@gilcu3): Update wasmtime to avoid vulnerability in CVE-2026-27204 (#2237)
#2257(@gilcu3): Bug in from_be_bytes_mod_order when not a multiple of 8 bytes (#2257)
#2268(@gilcu3): Use bounded incoming message buffers for all protocols (#2268)
#2308(@gilcu3): Reject foreign chain transaction if requested chain not in policy (#2308)
#2310(@netrome): Don't log raw mpc protocol messages (#2310)
#2309(@gilcu3): Reject wrong payload versions for foreign chain transaction (#2309)
#2317(@netrome): Ensure resharing leaders wait for start events to prevent them from getting stuck forever (#2317)

#2251(@gilcu3): Rework the mpc readme (#2251)
#2270(@barakeinav1): CVM upgrade mechanism with launcher and OS measurement voting (#2270)
#2204(@pbeza): Archive Signer design for legacy HOT key support (#2204)

#2212(@pbeza): Rename docs and scripts to kebab-case, add file naming CI check (#2212)
#2169(@pbeza): Add check-use-in-fn.py CI script (#2169)
#2227(@gilcu3): Add ts crate to the workspace (#2227)
#2229(@netrome): Make CLAUDE.md a symlink to AGENTS.md (#2229)
#2172(@barakeinav1): Launcher update process guide and automation script (#2172)
#2249(@gilcu3): Make dependabot separate minor bumps from major bumps (#2249)
#2259(@DSharifi): Create standalone crate to verify signatures that are in dto format (#2259)
#2278(@dependabot[bot]): Bump the rust-minor-and-patch group with 2 updates (#2278)
#2304(@gilcu3): Allow concurrent execution of release image workflow (#2304)
#2235(@gilcu3): Update migration code and contract history after 3.5.1 is deployed (#2235)
#2312(@gilcu3): Build docker workflows cancelling each other (#2312)
#2314(@gilcu3): Update nearcore to 2.10.7 (#2314)

nearone/mpc-node:3.6.0
Manifest digest: sha256:b455b7bc476b0c9cdcf3ab48201b83645b560d5f7644a2b5b3ca63acdf1cc4b0
Image ID: sha256:9143bc98aaae3408c14cf4490d7b0e96a5a32d989ec865a0cf8dde391831a7a9
nearone/mpc-node-gcp:3.6.0
Manifest digest: sha256:dba747045c5b5eb651ed662d0ba304fcc7e0a390a28bd479075e29cf9e54430f
Image ID: sha256:2af03f303da5eefa8b736f5502f9236bd31a13573ae3541d00b86547c8e77730
nearone/mpc-launcher:3.6.0
Manifest digest: sha256:e28cb0425db06255fe5fc7aadb79534ac63c94c7a721f75c1af1e934d2eb0701
Image ID: sha256:ee41ad2278d14dff2e32e64adab393f727cc53f98b6e8e377ce5c9e386221a4c

digest: sha256:ca9d355bc70c2f1ef5768aa3943031bd52614befd16a2c5623bdf2bd14f06282