Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/package_validate_test.go

@@ -0,0 +1,166 @@
+package handlers
+
+import (
+	"testing"
+)
+
+func TestValidateManifest_ValidSurface(t *testing.T) {
+	m := map[string]any{
+		"id":    "my-surface",
+		"title": "My Surface",
+		"type":  "surface",
+	}
+	info, err := ValidateManifest(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if info.ID != "my-surface" {
+		t.Errorf("expected id 'my-surface', got %q", info.ID)
+	}
+	if info.Type != "surface" {
+		t.Errorf("expected type 'surface', got %q", info.Type)
+	}
+	if info.Version != "0.0.0" {
+		t.Errorf("expected default version '0.0.0', got %q", info.Version)
+	}
+}
+
+func TestValidateManifest_MissingID(t *testing.T) {
+	m := map[string]any{
+		"title": "No ID",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for missing id")
+	}
+}
+
+func TestValidateManifest_MissingTitle(t *testing.T) {
+	m := map[string]any{
+		"id": "no-title",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for missing title")
+	}
+}
+
+func TestValidateManifest_InvalidID(t *testing.T) {
+	m := map[string]any{
+		"id":    "UPPERCASE-BAD",
+		"title": "Bad ID",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for invalid package id")
+	}
+}
+
+func TestValidateManifest_InvalidType(t *testing.T) {
+	m := map[string]any{
+		"id":    "my-pkg",
+		"title": "My Package",
+		"type":  "invalid",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for invalid type")
+	}
+}
+
+func TestValidateManifest_ExtensionNoTools(t *testing.T) {
+	m := map[string]any{
+		"id":    "my-ext",
+		"title": "My Extension",
+		"type":  "extension",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for extension without tools/pipes/hooks")
+	}
+}
+
+func TestValidateManifest_LibraryNoExports(t *testing.T) {
+	m := map[string]any{
+		"id":    "my-lib",
+		"title": "My Library",
+		"type":  "library",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for library without exports")
+	}
+}
+
+func TestValidateManifest_ValidLibrary(t *testing.T) {
+	m := map[string]any{
+		"id":      "my-lib",
+		"title":   "My Library",
+		"type":    "library",
+		"version": "1.2.0",
+		"exports": []any{"module_a", "module_b"},
+	}
+	info, err := ValidateManifest(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if info.Version != "1.2.0" {
+		t.Errorf("expected version '1.2.0', got %q", info.Version)
+	}
+	if !info.HasExports {
+		t.Error("expected HasExports to be true")
+	}
+}
+
+func TestValidateManifest_NilManifest(t *testing.T) {
+	_, err := ValidateManifest(nil)
+	if err == nil {
+		t.Fatal("expected error for nil manifest")
+	}
+}
+
+func TestValidateManifest_SignatureField(t *testing.T) {
+	m := map[string]any{
+		"id":        "my-pkg",
+		"title":     "Signed Package",
+		"type":      "surface",
+		"signature": "sha256:abc123",
+	}
+	info, err := ValidateManifest(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if info.Signature != "sha256:abc123" {
+		t.Errorf("expected signature 'sha256:abc123', got %q", info.Signature)
+	}
+}
+
+func TestValidateManifest_Dependencies(t *testing.T) {
+	m := map[string]any{
+		"id":    "consumer",
+		"title": "Consumer Package",
+		"type":  "surface",
+		"dependencies": map[string]any{
+			"chat-core": ">=1.0.0",
+		},
+	}
+	info, err := ValidateManifest(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(info.Dependencies) != 1 {
+		t.Errorf("expected 1 dependency, got %d", len(info.Dependencies))
+	}
+}
+
+func TestValidateManifest_WorkflowNoDef(t *testing.T) {
+	m := map[string]any{
+		"id":    "my-wf",
+		"title": "My Workflow",
+		"type":  "workflow",
+	}
+	_, err := ValidateManifest(m)
+	if err == nil {
+		t.Fatal("expected error for workflow without workflow_definition")
+	}
+}