Feat v0.7.0 shell contract + surface audit + rebrand

Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/events/bus_test.go

@@ -236,3 +236,29 @@ func TestToolResultRouteBoth(t *testing.T) {
 		t.Error("tool.result.* should route DirBoth (filtered by WS subscriber, not routing table)")
 	}
 }
+
+func TestShellContractEventRoutes(t *testing.T) {
+	// package.changed — broadcast to all clients
+	if !ShouldSendToClient("package.changed") {
+		t.Error("package.changed should be sent to client")
+	}
+	if ShouldAcceptFromClient("package.changed") {
+		t.Error("package.changed should NOT be accepted from client")
+	}
+
+	// auth.changed — targeted to specific user
+	if !ShouldSendToClient("auth.changed") {
+		t.Error("auth.changed should be sent to client")
+	}
+	if ShouldAcceptFromClient("auth.changed") {
+		t.Error("auth.changed should NOT be accepted from client")
+	}
+
+	// notification.all_read — targeted to specific user
+	if !ShouldSendToClient("notification.all_read") {
+		t.Error("notification.all_read should be sent to client")
+	}
+	if ShouldAcceptFromClient("notification.all_read") {
+		t.Error("notification.all_read should NOT be accepted from client")
+	}
+}