Feat v0.9.4 package adoption + roles

Packages can declare `adoptable: true` in their manifest. When a team
adopts an adoptable package, a team-scoped copy is created that references
the original via `adopted_from` (shared assets, no disk duplication).
The package's `requires_roles` auto-populate into a new `team_role_catalog`
table so team admins know which roles to assign.

Migration 017: adoptable/adopted_from columns on packages, team_role_catalog
table. 4 new endpoints (adopt, list adoptable, unadopt, role catalog).
AdoptTeamWorkflow deprecated. 11 new tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,58 @@
 
 All notable changes to Armature are documented here.
 
+## v0.9.4 — Package Adoption + Roles
+
+Packages can now declare `adoptable: true` in their manifest. When a team
+adopts an adoptable package, a team-scoped copy is created that references
+the original (shared assets, no disk duplication). The package's
+`requires_roles` auto-populate into a new `team_role_catalog` table so
+team admins know which roles to assign.
+
+**Schema**
+
+- Migration 017: `adoptable` and `adopted_from` columns on `packages`.
+  `team_role_catalog` table (team_id, role, source_package_id) with
+  unique constraint. Both Postgres and SQLite dialects.
+
+**Store + Models**
+
+- `PackageRegistration`: `Adoptable bool`, `AdoptedFrom *string`.
+- `PackageStore`: `ListAdoptable()`, `GetByAdoptedFrom()`.
+- `TeamRoleCatalogEntry` model struct.
+- `TeamStore`: `AddRoleToCatalog`, `ListRoleCatalog`,
+  `RemoveRoleCatalogBySource`.
+
+**Handlers**
+
+- `POST /teams/:teamId/packages/:id/adopt` — adopt a global adoptable
+  package into the team. Creates team-scoped registration, clones
+  workflow if applicable, populates role catalog. Idempotent.
+- `GET /teams/:teamId/packages/adoptable` — list available packages
+  with adoption status per team.
+- `DELETE /teams/:teamId/packages/:id/unadopt` — remove adopted package
+  and clean up role catalog entries.
+- `GET /teams/:teamId/roles/catalog` — list known roles for a team.
+
+**Manifest Validation**
+
+- `adoptable: true` parsed as `ManifestInfo.Adoptable`.
+- Rejected on `library` and `test-runner` types.
+- Persisted to DB on package install.
+
+**Deprecation**
+
+- `POST /teams/:teamId/workflows/:id/adopt` (`AdoptTeamWorkflow`) now
+  returns `X-Deprecated` header and logs a deprecation warning.
+  Use the package-level adoption endpoint instead.
+
+**Tests**
+
+- 11 new tests: 5 manifest validation, 3 role catalog store, 3 handler
+  integration (adopt success, idempotent, non-adoptable rejection).
+
+---
+
 ## v0.9.3 — Team User Roles
 
 Promotes the team role system from a single-role-per-member model to a