Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/events/bus.go

@@ -112,6 +112,8 @@ func (b *Bus) publishLocal(event Event) {
 // in separate goroutines. Useful for I/O-heavy handlers.
 // Also calls the broadcastHook asynchronously if set.
 func (b *Bus) PublishAsync(event Event) {
+	b.publishCount.Add(1)
+
 	b.mu.RLock()
 	var matched []Handler
 	for pattern, subs := range b.subs {
@@ -125,6 +127,7 @@ func (b *Bus) PublishAsync(event Event) {
 	b.mu.RUnlock()
 
 	for _, h := range matched {
+		b.deliverCount.Add(1)
 		go h(event)
 	}
 	if hook != nil {