[onexbot-occ-writer]

Summary

Automated post-release disarm step (OMN-13912). Publishing v0.38.35 left dev's [project].version equal to the highest published tag, which ARMS the OMN-13412 release-identity gate (scripts/check_release_identity.py) against every subsequent dev PR that touches src/**.

This PR bumps [project].version to 0.38.36 and re-locks uv.lock, so the gate is disarmed by the same flow that armed it rather than by whichever unrelated PR trips it first.

Ticket

OMN-13912 — release train must auto-bump project.version post-publish.

Triggered by

Release workflow: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/35488227565

Test plan

• release-identity is green on this PR (that IS the behaviour under test)
• CI passes (lockfile resolves, version matrix in sync)

Evidence-Ticket: OMN-13912
Evidence-Source: OCC#10513

[jonahgabriel]

Runner image identity lock regenerated (lane infra-runner-identity-0715)

Pushed fc7bef686 onto this branch (fast-forward, no force).

Cause — branch-local, not repo-wide. origin/dev at f2fb6a78 verifies clean:

runner image identity verified: v8 e12bb12b166d88f3dfb9f926417877df

This PR's own diff moves the digest. uv.lock participates in the shared CI env digest as raw bytes (ci_env_digest.DEFAULT_ENV_INPUTS), and the post-release bump rewrites the root project's own version line inside it:

 [[package]]
 name = "omnibase-infra"
-version = "0.38.35"
+version = "0.38.36"
 source = { editable = "." }

Reproduced locally off this PR's head 7a3e8ccec:

	value
recorded	c6de4b1b2c5b30149dbe9663
recomputed	93c14dd44c7dc0fc41837016

which matches what runner-image-build-smoke reported.

Remedy. scripts/ci/runner_image_identity.py --mode generate, the command the failing job names in its own error text. Only identity_digest and shared_env_digest move; every pinned tool version (base image, Python, uv, runner, gh, kubectl, trivy) is unchanged. Local proof: --mode verify passes, tests/ci/test_runner_image_identity.py 11 passed, pre-commit run --all-files clean.

Root cause, recommended forward, not taken here. This is the sixth recurrence tonight (#3840, #3851, #3854, #3855 twice, #3857) and it will recur on every future version bump. shared_env_install_args is --frozen --all-extras --all-groups --no-install-project, so the root project is never installed and its version cannot reach the image. Binding it is the same over-binding OMN-18351 already removed for pyproject.toml, where the recorded reason was that hashing bytes the bake never installs made the correct value unknowable on a pull request. Narrowing uv.lock participation to exclude the editable root package's version would close it without weakening the binding. There is already a dependabot-runner-image-lock-refresh workflow that regenerates the lock on the same branch for dependency-manifest changes; extending that trigger to the post-release bump branch is the cheaper alternative.