chore(cli-version): verify agy against 1.3.5

[kaizhou-lab]

Moves VERIFIED_AGY_VERSION from 1.3.1 to 1.3.5, the version the antigravity updater manifest serves (darwin_arm64).

Gate	Result
A — contract	NONE — agy publishes no protocol schema
B — live e2e	PASS 7/7, 221.07s
C — release notes (manual)	CLEAR — 1.3.2–1.3.5 triaged; two items on our surface probed

The candidate was downloaded from the manifest URL, and its sha512 matched. The suite log reports only cli=agy version=1.3.5. The binary's mtime and size were unchanged before and after every run.

1.3.2, 1.3.3 and 1.3.4 were each blocked on earlier nights because no notes existed for them yet. The changelog bundled in 1.3.5 now covers all four releases. The web changelog still stops at 1.3.1.

Behaviour change worth knowing: plan mode now stops for review

1.3.2: --dangerously-skip-permissions no longer auto-approves the agent's implementation plan in plan mode; plans wait for review.

When a user picks plan mode, we pass --mode plan together with --dangerously-skip-permissions (antigravity/argv.rs). I probed this with exactly that argv:

• Turn 1 ended in 47s with status=SUCCESS. The reply presents implementation_plan.md and asks for approval, and no files are written. It does not hang.
• Turn 2 used the same mode and resumed with --conversation, with the prompt "The plan is approved. Proceed". It implemented and tested the code in 138s.

Plan mode now pauses for the user instead of running straight through. That fits what plan mode means, and a follow-up message continues the work, so this is not a veto. No A/B against ≤1.3.1 was possible, because agy keeps no old binaries. Gate B has no plan-mode test, so the probe is the evidence.

Other items

release	note	assessment
1.3.3	the macOS sandbox blocks sandboxed commands from reading ~/Library/Application Support	Probed with our argv: listing that directory succeeded. Not blocked on our path.
1.3.4	--model accepts a base name without --effort; unknown --agent exits 1	We pass the full model id, and never pass --effort or --agent
1.3.4	retry backoff capped at 30s	A fix in our favour
1.3.5	new --mode auto (seen in the --help diff)	Additive; we forward only the modes AionUi selects

The full record is in ~/aion/protocols/samples/antigravity-cli/1.3.5/gate-c-manual.md, with the probe captures alongside it.

Only the constant and its pinned assertions change. Targeted cargo test -p aionui-session --lib cli_version (14 passed), clippy and fmt are clean.