Add use-case recipes and smoke packs

Turn the stable workspace surface into five documented, runnable stories with a shared guest-backed smoke runner, new docs/use-cases recipes, and Make targets for cold-start validation, repro/fix loops, parallel workspaces, untrusted inspection, and review/eval workflows.

Bump the package and catalog surface to 3.6.0, update the main docs to point users from the stable workspace walkthrough into the recipe index and smoke packs, and mark the 3.6.0 roadmap milestone done.

Fix a regression uncovered by the real parallel-workspaces smoke: workspace_file_read must not bump last_activity_at. Verified with uv lock, UV_CACHE_DIR=.uv-cache make check, UV_CACHE_DIR=.uv-cache make dist-check, and USE_CASE_ENVIRONMENT=debian:12 UV_CACHE_DIR=.uv-cache make smoke-use-cases.

README.md

@@ -18,11 +18,12 @@ It exposes the same runtime in three public forms:
 - Vision: [docs/vision.md](docs/vision.md)
 - Workspace GA roadmap: [docs/roadmap/task-workspace-ga.md](docs/roadmap/task-workspace-ga.md)
 - LLM chat roadmap: [docs/roadmap/llm-chat-ergonomics.md](docs/roadmap/llm-chat-ergonomics.md)
+- Use-case recipes: [docs/use-cases/README.md](docs/use-cases/README.md)
 - First run transcript: [docs/first-run.md](docs/first-run.md)
 - Stable workspace walkthrough GIF: [docs/assets/workspace-first-run.gif](docs/assets/workspace-first-run.gif)
 - Terminal walkthrough GIF: [docs/assets/first-run.gif](docs/assets/first-run.gif)
 - PyPI package: [pypi.org/project/pyro-mcp](https://pypi.org/project/pyro-mcp/)
-- What's new in 3.5.0: [CHANGELOG.md#350](CHANGELOG.md#350)
+- What's new in 3.6.0: [CHANGELOG.md#360](CHANGELOG.md#360)
 - Host requirements: [docs/host-requirements.md](docs/host-requirements.md)
 - Integration targets: [docs/integrations.md](docs/integrations.md)
 - Public contract: [docs/public-contract.md](docs/public-contract.md)
@@ -59,7 +60,7 @@ What success looks like:
 ```bash
 Platform: linux-x86_64
 Runtime: PASS
-Catalog version: 3.5.0
+Catalog version: 3.6.0
 ...
 [pull] phase=install environment=debian:12
 [pull] phase=ready environment=debian:12
@@ -81,6 +82,11 @@ access to `registry-1.docker.io`, and needs local cache space for the guest imag
 agent needs one sandbox to stay alive across repeated commands, shells, services, checkpoints,
 diffs, exports, and reset.
 
+After that stable walkthrough works, continue with the recipe set in
+[docs/use-cases/README.md](docs/use-cases/README.md). It packages the five core workspace stories
+into documented flows plus real guest-backed smoke targets such as `make smoke-use-cases` and
+`make smoke-repro-fix-loop`.
+
 The commands below use plain `pyro ...`. Run the same flow with `uvx --from pyro-mcp pyro ...`
 for the published package, or `uv run pyro ...` from a source checkout.
 
@@ -189,7 +195,7 @@ uvx --from pyro-mcp pyro env list
 Expected output:
 
 ```bash
-Catalog version: 3.5.0
+Catalog version: 3.6.0
 debian:12 [installed|not installed] Debian 12 environment with Git preinstalled for common agent workflows.
 debian:12-base [installed|not installed] Minimal Debian 12 environment for shell and core Unix tooling.
 debian:12-build [installed|not installed] Debian 12 environment with Git and common build tools preinstalled.
@@ -305,7 +311,7 @@ Persistent workspaces start in `/workspace` and keep command history until you d
 machine consumption, add `--json` and read the returned `workspace_id`. Use `--seed-path` when
 you want the workspace to start from a host directory or a local `.tar` / `.tar.gz` / `.tgz`
 archive instead of an empty workspace. Use `pyro workspace sync push` when you want to import
-later host-side changes into a started workspace. Sync is non-atomic in `3.5.0`; if it fails
+later host-side changes into a started workspace. Sync is non-atomic in `3.6.0`; if it fails
 partway through, prefer `pyro workspace reset` to recover from `baseline` or one named snapshot.
 Use `pyro workspace diff` to compare the live `/workspace` tree to its immutable create-time
 baseline, and `pyro workspace export` to copy one changed file or directory back to the host. Use