v2.3.6 — community-response release

Community-response release. Built from a full audit of every open PR, issue, and discussion — community fixes merged with credit, verified defects fixed (including two open Windows bugs), benchmark claims made independently checkable, and the project's first self-hosted PR review bot: this repo now reviews its own pull requests with its own graph.

Highlights

• Custom languages without forking (#320): drop a .code-review-graph/languages.toml into your repo to index any grammar shipped by tree-sitter-language-pack. See docs/CUSTOM_LANGUAGES.md.
• GitHub Action for risk-scored PR reviews: builds/restores the graph from CI cache and posts a sticky review comment with risk table, affected flows, test gaps, and token savings. See docs/GITHUB_ACTION.md.
• Honest benchmarks: new agent_baseline benchmark (graph vs a realistic grep-and-read agent), failed eval runs excluded from aggregates instead of inflating them, non-circular co-change ground truth for impact accuracy, weekly report-only eval CI. README now leads with the ~82x median; 528x is the best case, not the headline.
• docs/FAQ.md: vs LSP, vs RAG, vs agentic grep, when NOT to use this tool, and how to verify it's working.

Fixes

• Windows: daemon status WinError 87 crash (#511) and CLI detect-changes mapping 0 functions (#528)
• store_file_batch transaction guard (#489 — community PR #529 by @Devilthelegend, thank you)
• Unknown embedding providers now error instead of silently using the local model
• Analysis tools no longer leak SQLite connections; fastmcp capped <4; git hooks now work in worktrees and core.hooksPath/husky setups; shipped hooks drain stdin
• Translated READMEs carry staleness banners and no longer contradict the English benchmark numbers

Full details in CHANGELOG.md. No breaking changes.