Release/1136.0.0

[Jwhiles]

Explanation

release new versions of the chomp service package and the money upgrade controller

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
The release ships multiple breaking API and persisted-state changes for Money account upgrade and CHOMP address association; consumers must adopt new versions, messenger grants, and state shape even though this PR only bumps versions.

Overview
Release-only PR — no new runtime code in the diff; it finalizes versions, changelogs, and yarn.lock for packages whose behavior already landed in earlier PRs.

@metamask/chomp-api-service@4.0.0 documents 4.0.0 with getAssociatedAddresses / ChompApiService:getAssociatedAddresses, and a breaking change where associateAddress throws HttpError on HTTP 409 instead of parsing the error body.

@metamask/money-account-upgrade-controller@3.0.0 documents 3.0.0 with breaking persisted upgradedAccounts state (config fingerprint), upgradeAccount skip/record behavior, terminal upgrade errors, and an associate-address step that uses getAssociatedAddresses (requires messenger permission and chomp-api-service ≥ 4.0.0). The controller dependency moves from ^3.1.0 to ^4.0.0.

Root package.json version goes 1135.0.0 → 1136.0.0.

^{Reviewed by Cursor Bugbot for commit ff9121a. Bugbot is set up for automated code reviews on this repo. Configure here.}