Feat v0.9.3 team user roles (#77)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/package_validate.go

@@ -33,6 +33,7 @@ type ManifestInfo struct {
 	Signature       string // reserved for future package signing
 	UserPermissions []string // user-facing permissions declared by the extension
 	GatePermission  string   // if set, checks this user permission before calling on_request
+	RequiresRoles   []string // team roles needed to access this package (advisory, OR semantics)
 }
 
 // ValidateManifest parses a manifest map and validates all required fields,
@@ -168,6 +169,15 @@ func ValidateManifest(manifest map[string]any) (*ManifestInfo, error) {
 	}
 	info.GatePermission, _ = manifest["gate_permission"].(string)
 
+	// v0.9.3: requires_roles — team roles needed to access this package (advisory)
+	if rr, ok := manifest["requires_roles"].([]any); ok {
+		for _, v := range rr {
+			if s, ok := v.(string); ok && s != "" && len(s) <= 50 {
+				info.RequiresRoles = append(info.RequiresRoles, s)
+			}
+		}
+	}
+
 	info.SchemaVersion = ParseSchemaVersion(manifest)
 
 	// ── Type-specific constraints ────────────────────────────────