Feat v0.9.4 package adoption + roles

Packages can declare `adoptable: true` in their manifest. When a team
adopts an adoptable package, a team-scoped copy is created that references
the original via `adopted_from` (shared assets, no disk duplication).
The package's `requires_roles` auto-populate into a new `team_role_catalog`
table so team admins know which roles to assign.

Migration 017: adoptable/adopted_from columns on packages, team_role_catalog
table. 4 new endpoints (adopt, list adoptable, unadopt, role catalog).
AdoptTeamWorkflow deprecated. 11 new tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -208,6 +208,23 @@ type TeamStore interface {
 
 	// RemoveAllUserRoles deletes all additional roles for a member (cleanup on removal).
 	RemoveAllUserRoles(ctx context.Context, teamID, userID string) error
+
+	// ── v0.9.4 — Team Role Catalog ──
+
+	// AddRoleToCatalog registers a known role for the team. Idempotent.
+	AddRoleToCatalog(ctx context.Context, teamID, role, sourcePkgID string) error
+
+	// ListRoleCatalog returns all known roles for a team.
+	ListRoleCatalog(ctx context.Context, teamID string) ([]TeamRoleCatalogEntry, error)
+
+	// RemoveRoleCatalogBySource removes all catalog entries sourced from a package.
+	RemoveRoleCatalogBySource(ctx context.Context, teamID, sourcePkgID string) error
+}
+
+// TeamRoleCatalogEntry represents a known role sourced from an adopted package.
+type TeamRoleCatalogEntry struct {
+	Role            string `json:"role"`
+	SourcePackageID string `json:"source_package_id,omitempty"`
 }
 
 // =========================================