Feat v0.9.4 package adoption + roles

Packages can declare `adoptable: true` in their manifest. When a team
adopts an adoptable package, a team-scoped copy is created that references
the original via `adopted_from` (shared assets, no disk duplication).
The package's `requires_roles` auto-populate into a new `team_role_catalog`
table so team admins know which roles to assign.

Migration 017: adoptable/adopted_from columns on packages, team_role_catalog
table. 4 new endpoints (adopt, list adoptable, unadopt, role catalog).
AdoptTeamWorkflow deprecated. 11 new tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/sqlite/team.go

@@ -8,6 +8,8 @@ import (
 
 	"armature/models"
 	"armature/store"
+
+	"github.com/google/uuid"
 )
 
 type TeamStore struct{}
@@ -399,3 +401,40 @@ func (s *TeamStore) RemoveAllUserRoles(ctx context.Context, teamID, userID strin
 		teamID, userID)
 	return err
 }
+
+// ── v0.9.4 — Team Role Catalog ──
+
+func (s *TeamStore) AddRoleToCatalog(ctx context.Context, teamID, role, sourcePkgID string) error {
+	_, err := DB.ExecContext(ctx, `
+		INSERT INTO team_role_catalog (id, team_id, role, source_package_id)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT (team_id, role) DO NOTHING`,
+		uuid.New().String(), teamID, role, sourcePkgID)
+	return err
+}
+
+func (s *TeamStore) ListRoleCatalog(ctx context.Context, teamID string) ([]store.TeamRoleCatalogEntry, error) {
+	rows, err := DB.QueryContext(ctx, `
+		SELECT role, COALESCE(source_package_id, '') FROM team_role_catalog
+		WHERE team_id = ? ORDER BY role`, teamID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var result []store.TeamRoleCatalogEntry
+	for rows.Next() {
+		var e store.TeamRoleCatalogEntry
+		if err := rows.Scan(&e.Role, &e.SourcePackageID); err != nil {
+			return nil, err
+		}
+		result = append(result, e)
+	}
+	return result, rows.Err()
+}
+
+func (s *TeamStore) RemoveRoleCatalogBySource(ctx context.Context, teamID, sourcePkgID string) error {
+	_, err := DB.ExecContext(ctx, `
+		DELETE FROM team_role_catalog WHERE team_id = ? AND source_package_id = ?`,
+		teamID, sourcePkgID)
+	return err
+}