Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/sdk-test-runner/js/domains/admin.js

@@ -149,5 +149,39 @@
       raw:      { method: 'GET', path: '/admin/projects' },
       validate: function (r) { T.assert(Array.isArray(r) || (r && Array.isArray(r.data)), 'expected array'); }
     });
+
+    // ── Metrics (v0.6.4+) ──
+
+    await T.test('admin', 'metrics', 'GET /admin/metrics (raw)', {
+      sdk:      function () { return sw.api.get('/admin/metrics'); },
+      raw:      { method: 'GET', path: '/admin/metrics' },
+      validate: function (r) {
+        T.assert(typeof r === 'object', 'expected object');
+        T.assertHasKey(r, 'runtime', 'metrics');
+        T.assertHasKey(r, 'database', 'metrics');
+      }
+    });
+
+    // ── Cluster (v0.6.0+) ──
+
+    await T.test('admin', 'cluster', 'GET /admin/cluster (raw)', {
+      sdk:      function () { return sw.api.get('/admin/cluster'); },
+      raw:      { method: 'GET', path: '/admin/cluster' },
+      validate: function (r) {
+        var arr = T.unwrapList(r);
+        T.assert(arr.length >= 0, 'expected cluster node list');
+      }
+    });
+
+    // ── Backups (v0.6.1+) ──
+
+    await T.test('admin', 'backups', 'GET /admin/backups (raw)', {
+      sdk:      function () { return sw.api.get('/admin/backups'); },
+      raw:      { method: 'GET', path: '/admin/backups' },
+      validate: function (r) {
+        var arr = T.unwrapList(r);
+        T.assert(arr.length >= 0, 'expected backup list');
+      }
+    });
   });
 })();