chore(ci): bump the fleet nox pin to 1.35.0

[felixgeelhaar]

Opened automatically by nox-pin-check. Do not merge without measuring first.

nox 1.35.0 is the latest release. sha256 8c1771cf80f5c82d9a99f4d66293181f13ff411bd39aefa149607e477968f258 comes from that release's checksums.txt, whose cosign signature was verified against the nox release workflow at this exact tag — so the pinned digest is provably from a signed release rather than whatever the endpoint served.

Why this needs a human

The fleet's nox gate fails on net-new critical/high for every repo with a committed baseline (~30 of them). A release that improves taint recall — which nox does often — adds findings, and that is the direction that red-lines repos.

Compare a few repos under both versions before merging. Anything that only removes findings is safe; anything that adds a critical/high is not:

# in a checkout of a representative repo, with both binaries to hand
nox-old scan . && cp findings.json /tmp/old.json
nox-new scan . && cp findings.json /tmp/new.json
# then diff by fingerprint, and check nothing high/critical is added

Pick repos across the languages the fleet actually uses, not just Go.

What changed here

All three reusable workflows move together — go-ci, js-ci and nox-remediate. They are asserted to agree afterwards, because a partial bump is the drift this check exists to end.