v0.3.6

Generated route and workspace access metadata and gating, deterministic route catalog matching, descriptor-aware app slots, and explicit impersonation-aware audit identity.