chore(release): 3.6.2 — commit SDK lockfiles (fixes failed SDK publish) (#71)

Real root cause of the 3.6.0/3.6.1 SDK build failures: sdk/{node,python}/Cargo.lock
were git-ignored, so CI re-resolved the SDK dep graph fresh each release and
pulled a newly-published alloc-no-stdlib 3.0.0 next to 2.0.4 — a duplicate that
breaks brotli 8.0.3's StandardAlloc: Allocator impl. (The 3.6.1 toolchain pin
was a misdiagnosis.)

- Track sdk/node/Cargo.lock + sdk/python/Cargo.lock (remove from .gitignore,
  add !Cargo.lock negation) so CI builds the exact pinned resolution: single
  alloc-no-stdlib 2.0.4 + brotli 8.0.3.
- Bump version surface 3.6.1 -> 3.6.2.
- Verified with real cargo build --release for BOTH SDKs locally (exit 0), not
  just cargo check.

Co-authored-by: Claude <claude@anthropic.com>

Author: ZhiXiao-Lin

CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.6.2] - 2026-06-14
+
+Release-engineering fix for 3.6.0/3.6.1 (no library code changes). Both prior
+tags published `a3s-code-core` to crates.io but failed every native SDK build,
+so npm / PyPI / GitHub Release were skipped.
+
+True root cause: **`sdk/{node,python}/Cargo.lock` were git-ignored** (never
+committed), so CI resolved the SDK dependency graph fresh on each release. A
+newly-published `alloc-no-stdlib 3.0.0` then got pulled alongside `2.0.4`,
+producing a duplicate that breaks `brotli 8.0.3`'s `StandardAlloc: Allocator`
+impl. (The 3.6.1 toolchain pin was a misdiagnosis — the build fails the same way
+on any toolchain when the lock isn't honored.)
+
+### Fixed
+
+- **Commit the SDK lockfiles** — `sdk/node/Cargo.lock` and
+  `sdk/python/Cargo.lock` are now tracked (removed from `.gitignore`), pinning a
+  single consistent `alloc-no-stdlib 2.0.4` + `brotli 8.0.3`. CI now builds the
+  exact, locally-verified resolution instead of re-resolving. Verified with the
+  real `cargo build --release` for both SDKs (not just `cargo check`).
+
 ## [3.6.1] - 2026-06-14
 
 Release-engineering fix for 3.6.0 (no library code changes). The 3.6.0 tag

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "3.6.1"
+version = "3.6.2"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/Cargo.toml

@@ -1,5 +1,5 @@
 /target
-Cargo.lock
 node_modules/
 *.node
 dist/
+!Cargo.lock