Bump version to v0.5.4, update changelog and roadmap

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.5.4 — Package Updates
+
+### Added
+
+- **Package update API**: `POST /api/v1/admin/packages/:id/update` accepts a
+  `.pkg` archive, validates semver version bump (rejects same/older), applies
+  additive schema migration, merges settings, replaces assets, and re-syncs
+  permissions/triggers/dependencies.
+- **Package export API**: `GET /api/v1/admin/packages/:id/export` streams the
+  installed package as a downloadable `.pkg` ZIP archive. Completes the manual
+  rollback story: export before update, re-install old `.pkg` if needed.
+- **Semver parsing**: `ParseSemver` / `Compare` in `handlers/semver.go` with
+  prerelease support. Used by the update handler to enforce version bumps.
+- **Additive schema migration**: `MigrateExtTables` diffs declared `db_tables`
+  against existing ext_data schema. Adds new columns (`ALTER TABLE ADD COLUMN`)
+  and new tables. No destructive changes — columns in DB but absent from
+  manifest are preserved. `ListExtColumns` introspects via `PRAGMA table_info`
+  (SQLite) or `information_schema` (Postgres).
+- **Settings merge on update**: New manifest setting keys get their declared
+  default value; existing admin-configured values are preserved.
+- **Admin UI Update button**: Non-core package cards now show an Update button
+  with a confirm dialog before upload.
+- **14 new Go tests**: Version bump, 5 rejection cases (same/older/core/type/id
+  mismatch), schema add column with data preservation, schema add table,
+  settings merge, export with valid zip, default allowlist, wildcard allowlist.
+
+### Changed
+
+- **Curated default bundle**: Default bundled packages reduced from 23 to 8
+  core packages (notes, chat-core, workflow-chat, dashboard, 4 demo workflows).
+  `BUNDLED_PACKAGES=*` installs all; explicit comma-separated list for custom.
+  Existing deployments are unaffected (install-once, skip-if-present).
+- **`BUNDLED_PACKAGES` env var**: Empty value now installs curated defaults
+  instead of all packages. Use `"*"` for previous install-all behavior.
+
 ## v0.5.3 — Chat Polish + Integration Testing
 
 ### Added

VERSION

@@ -1 +1 @@
-0.5.3
+0.5.4