chore: staging 0.35.1rc5 — logging audit, docs, pytest CVE fix

[Nathan Schram (nathanschram)]

Summary

• Add 38 missing structlog calls across 13 files (logging audit) [fix: add 38 missing structlog calls across 13 files (logging audit) #299]
• Expand docs/reference/changelog.md with full v0.35.1 entry
• Add security: bot token leaked in structured log URLs #190 (token redaction) and security: unbounded JSONL line buffer can cause OOM crash #191 (line buffer cap) to CHANGELOG.md
• Update CLAUDE.md test count (2038 → 2165)
• Bump pytest 9.0.2 → 9.0.3 (CVE-2025-71176)
• Bump version to 0.35.1rc5

Test plan

• CI format check passes
• CI ruff lint passes
• CI pytest passes on 3.12/3.13/3.14
• CI build + wheel check passes
• CI lockfile in sync
• CI pip-audit passes (pytest CVE fixed)
• TestPyPI publish succeeds after merge

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d446627b-2db9-4a5e-9445-89ded401d27f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/v0.35.1rc5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}