[AnthonyRonning]

Consumers previously always built the SDK source in the monorepo, coupling SDK development to every app and proxy release. This change defaults Research's frontend to @mapleai/sdk 3.5.2 and independently pins Research and Agent to maple-sdk 3.6.2. The reusable proxy accepts a compatible SDK version while its standalone lockfile fixes the deployed version.

Local file: and Cargo path/patch dependencies remain supported, including on master. The existing developer and release guidance recommends publishing and pinning an SDK before a client ships its unpublished changes, while allowing an intentional local-source release. There is no new policy gate or approval mechanism.

• Frontend preparation builds SDK source only when the consumer selects the local package. Its lockfile drops unused SDK development dependencies without changing retained third-party versions. Only @mapleai/sdk is exempted from the seven-day package-age delay so reviewed first-party SDK releases can be adopted immediately.
• Existing Rust graph checks accept canonical local source or crates.io and retain the single-SDK/local-proxy identity checks. All three Rust lockfiles change only the SDK registry source and checksum.
• Existing proxy version and immutable-image checks compare SDK source only when either revision's proxy lockfile consumes it locally. Publishing security and release authorization remain unchanged.

Validation passed:

• Host Nix flake checks, including workflow and publishing-boundary checks.
• Published and local npm preparation/runtime fixtures; frontend lint/typecheck.
• Normal commit hook: frontend formatting/build and 818 tests; Research native all-target tests, 415 passed and two existing ignores. The fresh workspace first needed the existing checksum-verified ONNX Runtime setup.
• Three locked Rust metadata graphs; six Rust graph tests; five proxy comparison tests and the release-gate suite. Registry Rust SDK source/assets match current monorepo bytes.
• Validation of all nine modified Skills; independent code/security and guidance reviews.

Cross-platform CI and deployed behavior remain separate checks. This PR does not publish an SDK or application release.