Feat v0.3.5 settings audit, ICD, clone + v0.3.6 roadmap

v0.3.5 deliverables:
- Clone endpoint (POST /workflows/:id/clone) with deep stage copy
- 7 engine integration tests (28 total): lifecycle, branch routing,
  public entry, signoff gate, rejection, cancel, error cases
- Settings audit: staleness_timeout_hours + branch_rules UI in
  team-admin workflow editor
- ICD: fixed stale schemas, added ~20 new endpoint paths for
  instances, assignments, signoffs, public entry, clone, team roles

Roadmap additions (v0.3.6–v0.3.8):
- v0.3.6: 4 example workflow packages + demo surface proving
  public entry, branch rules, Starlark automation, signoff gates,
  HTTP webhooks end-to-end
- v0.3.7: package audit for non-chat packages
- v0.3.8: builder image + bundled packages for zero-config first run

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -416,6 +416,7 @@ func main() {
 			protected.DELETE("/workflows/:id/stages/:sid", middleware.RequirePermission(auth.PermWorkflowCreate, stores), wfH.DeleteStage)
 			protected.PATCH("/workflows/:id/stages/reorder", middleware.RequirePermission(auth.PermWorkflowCreate, stores), wfH.ReorderStages)
 			protected.POST("/workflows/:id/publish", middleware.RequirePermission(auth.PermWorkflowCreate, stores), wfH.Publish)
+			protected.POST("/workflows/:id/clone", middleware.RequirePermission(auth.PermWorkflowCreate, stores), wfH.Clone)
 			protected.GET("/workflows/:id/versions/:version", wfH.GetVersion)
 
 			// Workflow instances + assignments (v0.3.2)
@@ -560,6 +561,7 @@ func main() {
 				teamScoped.DELETE("/workflows/:id/stages/:sid", teamWfH.DeleteTeamWorkflowStage)
 				teamScoped.PATCH("/workflows/:id/stages/reorder", teamWfH.ReorderTeamWorkflowStages)
 				teamScoped.POST("/workflows/:id/publish", teamWfH.PublishTeamWorkflow)
+				teamScoped.POST("/workflows/:id/clone", teamWfH.CloneTeamWorkflow)
 				teamScoped.GET("/workflows/:id/versions/:version", teamWfH.GetTeamWorkflowVersion)
 
 				// Team workflow instances + assignments (v0.3.2)