Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/icd-test-runner/js/tier-smoke.js

@@ -442,6 +442,48 @@
         T.assertHasKey(d, 'data', '/admin/memories/pending');
         T.assert(Array.isArray(d.data), 'data should be array');
       });
+
+      // -- v0.6.x Admin endpoints --
+
+      await T.test('smoke', 'admin', 'GET /admin/metrics', async function () {
+        var d = await T.apiGet('/admin/metrics');
+        T.assert(typeof d === 'object', 'expected object');
+        T.assertHasKey(d, 'runtime', '/admin/metrics');
+        T.assertHasKey(d, 'database', '/admin/metrics');
+      });
+
+      await T.test('smoke', 'admin', 'GET /admin/cluster', async function () {
+        var d = await T.apiGet('/admin/cluster');
+        T.assertHasKey(d, 'data', '/admin/cluster');
+        T.assert(Array.isArray(d.data), 'cluster nodes should be array');
+      });
+
+      await T.test('smoke', 'admin', 'GET /admin/backups', async function () {
+        var d = await T.apiGet('/admin/backups');
+        T.assertHasKey(d, 'data', '/admin/backups');
+        T.assert(Array.isArray(d.data), 'backups should be array');
+      });
     }
+
+    // -- Docs API --
+    await T.test('smoke', 'utility', 'GET /docs', async function () {
+      var d = await T.apiGet('/docs');
+      T.assertHasKey(d, 'data', '/docs');
+      T.assert(Array.isArray(d.data), 'docs should be array');
+    });
+
+    // -- Dynamic OpenAPI spec (outside /api/v1 prefix) --
+    await T.test('smoke', 'utility', 'GET /api/docs/openapi.json', async function () {
+      var token = await T.getAuthToken();
+      var resp = await fetch(T.base + '/api/docs/openapi.json', {
+        headers: { 'Authorization': 'Bearer ' + token },
+        credentials: 'same-origin'
+      });
+      T.assert(resp.ok, 'expected 200 from /api/docs/openapi.json, got ' + resp.status);
+      var d = await resp.json();
+      T.assertHasKey(d, 'openapi', 'openapi spec');
+      T.assertHasKey(d, 'paths', 'openapi spec');
+      T.assertHasKey(d, 'info', 'openapi spec');
+    });
   };
 })();