Feat v0.7.0 shell contract + surface audit + rebrand

Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/workflow-demo/js/main.js

@@ -134,7 +134,17 @@
             for (const wf of list) {
                 if (wf.slug) installed[wf.slug] = wf;
             }
-        } catch (e) { /* ignore — show all as not-installed */ }
+        } catch (e) {
+            const errDiv = document.createElement('div');
+            errDiv.className = 'sw-inline-error';
+            errDiv.innerHTML = '<span>' + _esc(e.message || 'Failed to load workflows') + '</span>';
+            const retryBtn = document.createElement('button');
+            retryBtn.className = 'sw-btn sw-btn--secondary sw-btn--sm';
+            retryBtn.textContent = 'Retry';
+            retryBtn.onclick = () => { errDiv.remove(); _mount(surface); };
+            errDiv.appendChild(retryBtn);
+            grid.appendChild(errDiv);
+        }
 
         for (const wf of WORKFLOWS) {
             grid.appendChild(_buildCard(wf, installed[wf.slug]));