v0.37.0

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.