Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.6.6 — Final Hardening
+
+Final pass before public release. Security, correctness, and developer
+experience. No new features — only fixes, validation, and cleanup.
+
+### Added
+
+- **`ValidateManifest()` gate**: Centralized manifest validation function
+  (`package_validate.go`) called at both upload-install and bundled-install
+  time. Catches malformed manifests early with clear error messages. 12 unit
+  tests covering all type constraints and edge cases.
+- **Extension dependency auto-activation**: Installing a package whose
+  `dependencies` list an uninstalled library will auto-install that library
+  from the bundled packages directory. If the dependency is not bundled, the
+  error message lists exactly what's missing.
+- **`OptionalAuth` middleware**: New page middleware for workflow visitor
+  routes. Authenticates if a token is present, allows anonymous pass-through
+  otherwise. Replaces the stale `AuthOrRedirect` TODO for Session routes.
+- **Package signing schema reservation**: `signature` field accepted in
+  manifest (no-op). `PACKAGE_VERIFY_SIGNATURES` env var logs warnings for
+  unsigned packages when enabled. No cryptographic verification yet — schema
+  slot reserved to prevent a breaking change later.
+- **ICD/SDK runner v0.6.x coverage**: Smoke tier adds metrics, cluster,
+  backups, docs, and OpenAPI JSON endpoints. SDK admin domain adds metrics,
+  cluster, and backups dual-path tests.
+
+### Fixed
+
+- **OIDC nonce validation**: ID token nonce claim is now validated against
+  the stored authorization request nonce. Previously the nonce was generated
+  and stored but never checked on callback — a token replay/substitution
+  vulnerability.
+
+### Changed
+
+- **Schema migration stub**: `RunSchemaMigrations()` no longer pretends to
+  work. Replaced with a log-only function documenting that only additive
+  schema changes are supported. Downgrade rejection preserved.
+- **Session middleware TODO resolved**: `main.go` Session slot now uses
+  `OptionalAuth` instead of `AuthOrRedirect`. OIDC nonce TODO and migration
+  stub TODO also resolved.
+
 ## v0.6.5 — Renderer Pipeline + Docs Rewrite
 
 Lifts block rendering to a kernel SDK primitive so all surfaces share one