chore: release 0.36.1

[JerrettDavis]

Description

Release 0.36.1, generated by Release Please, containing the security fixes from #2207 (WEB-01–07). This updates the changelog and keeps Python, TypeScript SDK, plugin package, marketplace, server, and release metadata versions aligned at 0.36.1.

Type of Change

• Release / version metadata

Changes Made

• Updated the release manifest and generated changelog for 0.36.1.
• Synchronized pyproject.toml, TypeScript SDK, OpenClaw, OpenCode, agent-hook plugin, marketplace, server, and release metadata versions.
• Included the 0.36.1 changelog entry for the security assessment fixes merged in security: address u9up assessment findings (WEB-01–07) #2207.

Testing

• CI and release validation pass

Test Output

All current required checks are complete and passing, including version sync, package builds, wheel smoke imports, security scans, Python test shards, native wrapper checks, and devcontainer validation.

Real Behavior Proof

• Environment: GitHub Actions release and CI workflows for commit 52c0a0c61dce0af81af3ff73a34efe8b451501cb.
• Observed result: all generated version-bearing files report 0.36.1; build and smoke-import jobs produced and validated the release artifacts.
• Not exercised: publishing jobs are intentionally skipped for a pull request and run only after the release receives final human approval and is merged.

Runtime Rollout Safety

• Rollout-managed features: none; this PR packages already-merged behavior.
• Stable/default behavior changed: no additional runtime behavior beyond the included, already-reviewed security fixes.
• Kill switch / disable path: not applicable to generated release metadata.
• Qualification impact: release artifact construction and smoke-import validation are green.
• Rollback path: do not merge the release PR, or revert the release commit before publishing.

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Release Notes

Bug Fixes

• security: address u9up assessment findings (WEB-01–07) (security: address u9up assessment findings (WEB-01–07) #2207)

This PR was generated with Release Please and then its description was expanded to document review and qualification evidence. It still requires final human review; no publishing or merge has been performed.

[github-actions]

PR governance

This PR does not yet satisfy the required template fields:

• Paste real command output or artifact links in Testing → Test Output.
• Fill in Real Behavior Proof → Exact command / steps.
• Fill in Real Behavior Proof → Not tested.
• Fill in Runtime Rollout Safety → Rollout-managed feature(s).
• Fill in Runtime Rollout Safety → Minimum rollout channel.
• Fill in Runtime Rollout Safety → Unsafe override required.

Please update the PR body, or move the PR back to draft while it is still in progress.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!