Feat v0.3.8 distribution (#21)

Bundled packages auto-install on first boot for zero-config first run.
Builder image for faster custom builds. Per-environment allowlists for
K8s/Helm (dev=all, test=all, prod=skip).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -174,6 +174,17 @@ func main() {
 		log.Printf("  ⚠️  Extension SSRF protection relaxed: private IPs allowed")
 	}
 
+	// ── Bundled Packages (v0.3.8) ───────────────
+	// Auto-install bundled .pkg archives on first run.
+	// Skipped if SKIP_BUNDLED_PACKAGES=true or packages already exist.
+	if !cfg.SkipBundledPackages && stores.Packages != nil {
+		bundledPkgDir := ""
+		if cfg.StoragePath != "" {
+			bundledPkgDir = cfg.StoragePath + "/packages"
+		}
+		handlers.InstallBundledPackages(cfg.BundledPackagesDir, bundledPkgDir, cfg.BundledPackages, stores, starlarkRunner)
+	}
+
 	// ── Trigger Engine (v0.2.2) ─────────────────
 	triggerEngine := triggers.New(stores, starlarkRunner, bus)
 	if err := triggerEngine.Start(context.Background()); err != nil {