Changeset 0.30.2 cs2 (#202)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.30.2] — 2026-03-18
+
+### Summary
+
+Workflow packages: workflows can be exported as `.pkg` bundles and
+imported on other instances. Custom stage surfaces load from installed
+packages via `surface_pkg_id`. Starlark `workflow.*` module provides
+sandbox access to workflow state. ICD test suite hardened (auth rate
+limiter, vault UEK pre-warm). 600 tests, 0 failures.
+
+### New
+
+- **Workflow package export/import** — `GET /admin/workflows/:id/export`
+  bundles a workflow definition + stages as a downloadable `.pkg` ZIP.
+  `POST /admin/packages/install` with `type: "workflow"` recreates
+  workflow definition + stages from the manifest. Round-trip tested in
+  ICD suite.
+- **Custom stage surfaces** — `surface_pkg_id` column on `workflow_stages`
+  links a stage to an installed package's JS surface. Template loads
+  the package's `main.js` via dynamic script import and mounts via
+  `WorkflowSurfaces.mount()`. Falls back to built-in mode rendering
+  when no custom surface is assigned.
+- **Starlark `workflow` module** — sandbox builtins: `workflow.get_definition`,
+  `workflow.get_stage_data`, `workflow.advance`, `workflow.reject`.
+  Gated by `workflow.access` permission.
+- **`sw.workflow` SDK namespace** — `mount()`, `registerSurface()`,
+  `getContext()`, `advance()`, `reject()` for frontend surface authors.
+- **Admin workflow builder** — visual stage editor with DnD reorder,
+  form field builder (8 types), export/import buttons, surface package
+  selector. No JSON editing required.
+- **ICD test fixes** — auth rate limiter burst 30→8 (transport test
+  expects 429 on 10th rapid login). Vault UEK pre-warm on startup via
+  variadic `ProbeAndRepairVault(*crypto.UEKCache)`.
+
+### Changed
+
+- `workflow_stages.surface_pkg_id` column added (migration 018, PG + SQLite)
+- `packages.source` CHECK widened to include `'registry'` (migration 016)
+- Auth rate limiter: `(5, 30)` → `(5, 8)` — do not increase burst above 9
+- ICD test count: 579 → 600 (with Venice BYOK configured)
+
+---
+
 ## [0.29.2] — 2026-03-17
 
 ### Summary