docs: expand v0.3.6 changelog with all commits since v0.3.5

Author: bug-ops

CHANGELOG.md

@@ -26,13 +26,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Bump rmcp from 1.3.0 to 1.4.0; remove now-redundant `tool_router` struct field (auto-generated by macro since 1.4.0)
+- Bump rmcp from 1.1.1 to 1.4.0; remove now-redundant `tool_router` struct field (auto-generated by the `#[tool_router]` macro since 1.4.0)
 - Bump tokio from 1.50.0 to 1.52.0
-- Bump toml from 1.1.1 to 1.1.2
+- Bump toml from 1.0.6 to 1.1.2
+- Bump clap from 4.5.60 to 4.6.0
+- Bump tracing-subscriber from 0.3.22 to 0.3.23
+- CI: pin all GitHub Actions to full commit SHAs for supply-chain security
+- CI: bump actions/checkout v4 → v6
+- CI: bump github/codeql-action v3 → v4
+- CI: bump codecov/codecov-action v5 → v6
+- CI: bump softprops/action-gh-release 2.6.1 → 3.0.0
+- CI: bump EmbarkStudios/cargo-deny-action 2.0.15 → 2.0.17
+- CI: bump lewagon/wait-on-check-action 1.5.0 → 1.7.0
 
 ### Fixed
 
-- CI: nightly rustfmt failures when `rustfmt` component is temporarily unavailable for the latest nightly build (`--allow-downgrade`)
+- CI: nightly rustfmt failures when the `rustfmt` component is temporarily unavailable for the latest nightly — now uses `rustup toolchain install nightly --component rustfmt --allow-downgrade`
+- CI: CodeQL workflow now runs for fork pull requests (`pull_request_target`)
+- CI: labeler workflow uses `pull_request_target` to access labels on fork PRs
 
 ## [0.3.5] - 2026-03-17