Feat v0.3.5 settings audit, ICD, clone + v0.3.6 roadmap

v0.3.5 deliverables:
- Clone endpoint (POST /workflows/:id/clone) with deep stage copy
- 7 engine integration tests (28 total): lifecycle, branch routing,
  public entry, signoff gate, rejection, cancel, error cases
- Settings audit: staleness_timeout_hours + branch_rules UI in
  team-admin workflow editor
- ICD: fixed stale schemas, added ~20 new endpoint paths for
  instances, assignments, signoffs, public entry, clone, team roles

Roadmap additions (v0.3.6–v0.3.8):
- v0.3.6: 4 example workflow packages + demo surface proving
  public entry, branch rules, Starlark automation, signoff gates,
  HTTP webhooks end-to-end
- v0.3.7: package audit for non-chat packages
- v0.3.8: builder image + bundled packages for zero-config first run

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/workflow_team.go

@@ -155,3 +155,13 @@ func (h *WorkflowHandler) GetTeamWorkflowVersion(c *gin.Context) {
 	}
 	h.GetVersion(c)
 }
+
+// CloneTeamWorkflow deep-copies a team workflow.
+// POST /api/v1/teams/:teamId/workflows/:id/clone
+func (h *WorkflowHandler) CloneTeamWorkflow(c *gin.Context) {
+	if !h.requireTeamWorkflow(c) {
+		return
+	}
+	c.Set("force_team_id", c.Param("teamId"))
+	h.Clone(c)
+}