chore: Release candid 0.10.36

[lwshang]

Patch release of candid / candid_derive, 0.10.35 → 0.10.36. No source changes — it dates the two decoder fixes that are already on master.

Summary

• Bump candid and candid_derive 0.10.35 → 0.10.36 (and the = pin between them), refresh Cargo.lock, rust/bench/Cargo.lock and tools/ui/Cargo.lock
• Move the Unreleased CHANGELOG entries into a dated 2026-09-22 / Candid 0.10.36 section, covering:
  • Scoping a map's decode fast paths to their own half of an entry, so a key and a value each decode under their own declared type (fix: Scope the map decode fast paths to their own half of an entry #768)
  • Sharing the decoder's undecoded argument queue behind a reference count, so skipping present optional arguments is no longer superlinear in the argument count (Share the decoder's argument queue to avoid superlinear option-skip cost #767)

tools/ui patches candid to the workspace path, so its lockfile pins the path crate's version and has to move with the bump. candid-ui-release.yml builds didjs there with --locked and triggers on the date tag this release creates, so a stale lock there would only fail at tag time, after merge — not in PR checks.

Test plan

• cargo check -p candid -p candid_derive -p candid_parser
• cargo test -p candid — all suites pass
• cd tools/ui && cargo build --target wasm32-unknown-unknown --profile canister --package didjs --locked — the release workflow's exact command, succeeds
• Reviewer to confirm release scope and changelog date
• Publish to crates.io after merge

Follow-up (not in this PR)

rust/candid/fuzz/Cargo.lock is stale at candid 0.10.34, already on master. Nothing builds it with --locked, so it is harmless, but all four lockfiles should move together as a release-checklist step.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to e2ddf61.

Security Overview

• 🔎 Scanned files: 6 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/7ddf29dd-76dc-4f78-adfa-47ac8f4643e7?scanId=93001537-14d3-49b3-b23e-56092a0add92&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Configuration changes	► CHANGELOG.md       Update changelog entry for 2026-09-22
Enhancement	► Cargo.lock       Bump candid and candid_derive versions from 0.10.35 to 0.10.36 across multiple packages ► rust/candid/Cargo.toml       Update candid version to 0.10.36 and adjust candid_derive dependency to 0.10.36 ► rust/candid_derive/Cargo.toml       Update version to 0.10.36 ► tools/ui/Cargo.lock       Bump candid and candid_derive versions to 0.10.36 across multiple packages

[marc0olo]

Lockfile fix confirmed. --locked now passes in all three workspaces, and the
verbatim didjs build command from candid-ui-release.yml builds clean — so the
date-tag workflow will go through.

Release itself checks out: no source changes, no 0.10.35 left anywhere, and the
changelog covers exactly #767 and #768, both on master. cargo test -p candid --features all green.

Non-blocking: rust/candid/fuzz/Cargo.lock is still at 0.10.34, stale since
before this release. Nothing builds it with --locked, but worth a checklist
line so all four lockfiles move together next time.

LGTM.