v0.3.5 — Fix ClawHub security flag

• Exclude SUBMISSIONS.md from ClawHub publish (contained example API key strings that triggered security scanner)
• Add references/ and SUBMISSIONS.md to .clawhubignore