Feat v0.5.0 realtime dialog (#30)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -2,6 +2,44 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.5.0 — Realtime Primitive + Dialog Audit + Permissions UI
+
+### Added
+
+- **Realtime Starlark module**: `realtime.publish(channel, event, data)` lets
+  extensions publish events to WebSocket channels. Gated by the new
+  `realtime.publish` permission. Payloads limited to 7KB (pg_notify safe).
+  Reserved event prefixes (`system.`, `workflow.`, etc.) are blocked.
+- **WS room protocol**: Clients send `room.subscribe` / `room.unsubscribe`
+  messages to join/leave rooms. Intercepted in the WebSocket readPump before
+  the bus publish gate (like ping). Per-connection cap of 100 rooms.
+- **SDK realtime module**: `sw.realtime.subscribe(channel, [event], callback)`
+  manages room join/leave over WebSocket and filters incoming `realtime.*`
+  events by room. Returns unsubscribe handle. Auto re-joins all rooms on
+  WebSocket reconnect. `sw.realtime.channels()` debug helper.
+- **Admin permissions UI**: Packages page gains a "Permissions" button for
+  packages with declared permissions. Inline drawer shows each permission with
+  Grant/Revoke toggle, granted-by user ID, and a "Grant All" bulk action.
+- **Status badges**: `pending_review` (amber) and `suspended` (red) badges on
+  package rows. Enable toggle disabled with hint when `pending_review`.
+- **SDK API client**: `permissions()`, `grantPerm()`, `revokePerm()`,
+  `grantAllPerms()` methods added to `sw.api.admin.packages`.
+- **`starlarkToGoVal()` helper**: Converts Starlark values to Go `any` for
+  JSON marshaling (reverse of existing `goValToStarlark`).
+- **8 new Go tests**: Route table cases for `realtime.*` and `room.*`,
+  realtime module publish (happy path, empty data, missing args, reserved
+  prefix, payload too large), `starlarkToGoVal` type conversion.
+
+### Changed
+
+- **Dialog audit**: 5 bare `confirm()` calls migrated to `await sw.confirm()`
+  with `{ destructive: true }` styling in tasks, schedules, notes (×2), and
+  editor packages. Package archives rebuilt.
+- SDK version bumped from 0.2.3 to 0.5.0.
+- Event route table: `realtime.` → DirToClient, `room.subscribe` /
+  `room.unsubscribe` → DirFromClient.
+- Runner gains `bus` field and `SetBus()` method; wired in main.go.
+
 ## v0.4.7 — Note Graph
 
 ### Added