v0.8.36 — Placeholder-CVE CI guard + type-checker/contract-layer wedge

Fixed

• Remove placeholder CVE ids from the preset registry (add CI guard). The registry was already free of placeholder ids; the one synthetic stub in-repo (CVE-2026-99999, an egress-bench date-filter test fixture) is replaced with a real disclosed CVE (CVE-2025-59528, Flowise) + NVD URL. New tests/test_no_placeholder_cves.py scans the registry source and fails on placeholder sequence numbers (99999/00000/12345), non-numeric stubs (CVE-XXXX-…), or any id off the canonical CVE-YYYY-NNNN shape — and asserts the real anchors are present so it can't no-op. (Structural invariant; live NVD resolution is not an offline unit test.)

Changed

• Docs: lead with the type-checker / contract-layer wedge. README hero + PyPI description now read "A type-checker and contract layer for AI agent tool calls — deny-by-default, in-process, zero-dep." Wording only — the @Airlock surface, deny-by-default posture, and Pydantic-only / zero-dep core are unchanged. (#104)