0.3.6

## New Web APIs
- Live SVG scalar values; SVG prototype chains derived
- `Float16Array` exposed (V8)
- `Dispose` event for `NavigationHistoryEntry`

## Web API behavior / fixes
- `XMLHttpRequest` uses the XML parser for XML content-type responses; fix XHR response handling
- `FormData` append blob fix
- Derive `scrollWidth`/`scrollHeight` from element content
- Improved `ResizeObserver` (behavior + performance)
- On script error, trigger `window.reportError`; fix segfault on `window.reportError`
- Forms: close the ancestor dialog on `method=dialog` submission
- `Blob` shared per origin

## CSS / rendering
- Respect `@layer` priority in the cascade

## CDP (Chrome DevTools Protocol)
- Complete `Network` events and include worker requests
- Per-CDP control for `Network.setCacheDisabled`
- Expose child-frame metadata; preserve node IDs across child-frame navigation
- Ignore duplicate `enable` calls
- Sanitize non-UTF-8 values
- Improved dead-peer detection

## HTTP / Networking
- Support loading custom CAs (`--ca-cert`, `--ca-path`)
- Cookie store; cookie improvements
- Request blocking fixes
- Improved `robots.txt` correctness
- Never cache the top-level root page
- `iframe` loads `about:blank` on an un-parsable URL
- WebSocket: use a posix shim for shutdown; improved WPT results and reduced flakiness

## Performance / memory
- Avoid a tight tick loop before pages load; don't poll when a message is dispatched
- Improve Runner tick signaling on macrotask-only waits
- Reduce GC hint frequency
- Inline finalizer callbacks
- Set a per-browser memory limit (instead of per-process) for WPT

## Stability fixes
- Poll the terminate state during large HTML parsing; interrupt nested script waits during teardown
- Make refcounts `u32` to prevent overflow
- Fix CLI help pager broken by the failing allocator

## CLI / Ops
- New `run` command for script replay
- Route script console output through an optional sink

## Build / CI
- Zig 0.16 upgrade; Nix flake updated for Zig 0.16
- Key the prebuilt-V8 cache on the zig-v8 tag
- Pin GitHub Actions to commit SHAs; add plumber to watch workflow security