Feat v0.9.4 package adoption + roles

Packages can declare `adoptable: true` in their manifest. When a team
adopts an adoptable package, a team-scoped copy is created that references
the original via `adopted_from` (shared assets, no disk duplication).
The package's `requires_roles` auto-populate into a new `team_role_catalog`
table so team admins know which roles to assign.

Migration 017: adoptable/adopted_from columns on packages, team_role_catalog
table. 4 new endpoints (adopt, list adoptable, unadopt, role catalog).
AdoptTeamWorkflow deprecated. 11 new tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/package_iface.go

@@ -93,6 +93,14 @@ type PackageStore interface {
 
 	// DeleteTeamSettings removes team-scoped overrides, reverting to global defaults.
 	DeleteTeamSettings(ctx context.Context, pkgID, teamID string) error
+
+	// ── v0.9.4 — Package Adoption ───────────────
+
+	// ListAdoptable returns global, adoptable, enabled packages.
+	ListAdoptable(ctx context.Context) ([]PackageRegistration, error)
+
+	// GetByAdoptedFrom returns a team's adopted copy of a source package, or nil.
+	GetByAdoptedFrom(ctx context.Context, sourceID, teamID string) (*PackageRegistration, error)
 }
 
 // PackageRegistration is a row from the packages table.
@@ -114,6 +122,8 @@ type PackageRegistration struct {
 	SchemaVersion   int             `json:"schema_version" db:"schema_version"`
 	PackageSettings json.RawMessage `json:"package_settings" db:"package_settings"`
 	Source          string          `json:"source" db:"source"`
+	Adoptable       bool            `json:"adoptable" db:"adoptable"`
+	AdoptedFrom     *string         `json:"adopted_from,omitempty" db:"adopted_from"`
 	InstalledAt     string          `json:"installed_at" db:"installed_at"`
 	UpdatedAt       string          `json:"updated_at" db:"updated_at"`
 }