chore(ci): bump go-FuSa pin from v0.30.0 to v0.36.0

.fusa-hara.json

@@ -61,39 +61,39 @@
       "hazards": ["H-001"],
       "asil": "ASIL-B",
       "safeState": "Application is signalled (via E2E CRC/counter mismatch) and discards the frame.",
-      "requirements": ["REQ-SAFETY-001", "REQ-SEC-001"]
+      "fssrRefs": ["REQ-SAFETY-001", "REQ-SEC-001"]
     },
     {
       "id": "SG-002",
       "description": "Frame loss caused by back-pressure shall be observable; drops shall be counted and the policy explicit, never silent under a Block contract.",
       "hazards": ["H-002"],
       "asil": "ASIL-B",
       "safeState": "Drop counters increment and are exposed via MetricsProvider for the application to detect.",
-      "requirements": ["REQ-VIRT-004", "REQ-SEC-003"]
+      "fssrRefs": ["REQ-VIRT-004", "REQ-SEC-003"]
     },
     {
       "id": "SG-003",
       "description": "DBC encode/decode shall be the exact inverse over the signal's representable range, with no silent truncation or wrap.",
       "hazards": ["H-003"],
       "asil": "ASIL-B",
       "safeState": "Out-of-range physical values are clamped deterministically; round-trip is verified.",
-      "requirements": ["REQ-DBC-005", "REQ-SEC-004"]
+      "fssrRefs": ["REQ-DBC-005", "REQ-SEC-004"]
     },
     {
       "id": "SG-004",
       "description": "ISO-TP reassembly shall reject any frame that violates the segmentation protocol (sequence number, length, type).",
       "hazards": ["H-004"],
       "asil": "ASIL-A",
       "safeState": "Reassembly aborts with an error; no partial message is delivered.",
-      "requirements": ["REQ-ISOTP-012", "REQ-SEC-002", "REQ-SEC-003"]
+      "fssrRefs": ["REQ-ISOTP-012", "REQ-SEC-002", "REQ-SEC-003"]
     },
     {
       "id": "SG-005",
       "description": "Every transmitted frame shall be validated against CAN/CAN-FD structural constraints before it reaches the bus.",
       "hazards": ["H-005"],
       "asil": "ASIL-B",
       "safeState": "Invalid frames are rejected at Send with ErrInvalidFrame; nothing is transmitted.",
-      "requirements": ["REQ-CAN-009", "REQ-CAN-010", "REQ-SEC-001"]
+      "fssrRefs": ["REQ-CAN-009", "REQ-CAN-010", "REQ-SEC-001"]
     }
   ]
 }

.github/workflows/ci.yml

@@ -170,12 +170,12 @@ jobs:
           ./socketcan/...
 
   # ── go-FuSa continuous-conformance lifecycle (RELAY spec §20.1.2) ──────────
-  # Pinned to v0.30.0. Runs the FULL lifecycle, not a subset: static check,
+  # Pinned to v0.36.0. Runs the FULL lifecycle, not a subset: static check,
   # 100% requirement traceability (traced AND tested + function-annotation
   # density), cybersecurity analysis, dependency vulnerability scan, and the
   # tool-qualification suite. Conformance must be continuously proven.
   gofusa:
-    name: go-FuSa lifecycle (§20, v0.30.0)
+    name: go-FuSa lifecycle (§20, v0.36.0)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -184,7 +184,7 @@ jobs:
           go-version: "1.25"
 
       - name: Install go-FuSa
-        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.30.0
+        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.36.0
 
       - name: gofusa check (gate on ERROR)
         run: gofusa check ./...

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
           go-version: "1.25"
 
       - name: Install go-FuSa
-        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.30.0
+        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.36.0
 
       - name: Regenerate dFMEA table
         run: gofusa fmea -cyber