Prepare the 3.5.0 release: trim make versions, refresh badges, and bump dependencies

[pambrose]

Summary

3.5.0 was never tagged, so everything since #130 folds into it rather than a new version, and its release date moves to 2026-10-12.

Release docs

• CHANGELOG.md, RELEASE_NOTES.md, and the website release notes now cover the zizmor audit, the Dependabot-maintained SHA pins, CodeQL's move to default setup, and the action upgrades from Bump the github-actions group with 6 updates #133. Each dependency is listed once, against 3.4.0.
• The feature lists in README.md and on the docs home page now include monitoring — 3.5.0's headline change.
• The server docs pointed at make cc, a target removed in 3.1.5; they now give the command it ran (./gradlew build --continuous -x test).

make versions

• Prints only the dependencies that are behind, any it could not check, and a pending Gradle update. make versions-all keeps the plugin's full report.
• Both run the root :dependencyUpdates alone. It already checks every module, and the unqualified task printed the same report three times.

README badges

• Adds Docs, CodeQL, zizmor, and License badges.
• The Kotlin, JVM, Ktor, and Gradle badges read their versions from gradle/libs.versions.toml on master, so they cannot fall behind the catalog. CLAUDE.md notes that renaming one of those keys breaks its badge.

Dependencies

• Exposed 1.5.0 → 1.5.1
• Cloud SQL socket factory 1.30.0 → 1.30.1
• prometheus-proxy 4.2.0 → 4.3.0
• versions plugin 0.65.0 → 0.66.0
• zensical 0.0.68 → 0.0.70
• pymdown-extensions 12.1 → 12.2

Test plan

• ./gradlew compileTestKotlin passes with the bumped dependencies
• make versions runs with versions plugin 0.66.0. It reports only jython-standalone 2.7.4 -> 2.7.5b1, a beta the pre-release filter does not catch.
• uv run zensical build builds the site with no issues against the upgraded lock
• All 14 README badge images render
• CI: Tests, Tailwind CSS, zizmor

🤖 Generated with Claude Code