chore(release): 0.35.0 — CodeAct sandboxed by default + verify-ledger CI gate

[New1Direction]

Release PR for 0.35.0. Bumps pyproject 0.34.0 → 0.35.0 and writes the changelog for everything merged since 0.34.0 (#97–#103).

Headline

• CodeAct sandboxed by default (feat(codeact): warn once when the kernel runs UNCONFINED (no OS isolation) #99, feat(codeact): isolate by default (auto) — sandbox when a backend exists #101) — KORGEX_CODEACT_ISOLATION auto/required/off; in-kernel code can't reach the network or write outside the workspace by default on Linux + macOS. CodeAct stays opt-in.
• macOS Seatbelt backend (feat(codeact): macOS Seatbelt sandbox backend for CodeAct isolation #100) — mirrors the Linux bubblewrap guarantees; live-validated on macOS 26.
• verify-ledger GitHub Action (feat(ci): verify-ledger GitHub Action — verify AI work as a CI gate #102, docs: surface the verify-ledger CI gate in the README #103) — recompute a receipt's hash-chain/DAG/signature in CI, fail on tamper; self-tested on real runners.
• Stale self-descriptions fixed (fix: correct stale self-descriptions (--resume is shipped; tests 1,263→1,571) #97, docs: --resume is implemented (fix stale cli-reference row) #98) — --resume, test badge.

On merge I'll publish a GitHub Release v0.35.0, which triggers publish.yml (PyPI Trusted Publishing, OIDC).