Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/packages_bundled.go

@@ -146,10 +146,14 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 		return "", err
 	}
 
-	pkgID, _ := manifest["id"].(string)
-	if pkgID == "" {
-		return "", fmt.Errorf("manifest missing 'id'")
+	// Validate manifest structure
+	mInfo, err := ValidateManifest(manifest)
+	if err != nil {
+		return "", fmt.Errorf("invalid manifest: %w", err)
 	}
+	pkgID := mInfo.ID
+	title := mInfo.Title
+	pkgType := mInfo.Type
 
 	// Skip if already exists (admin uninstalled → stays uninstalled)
 	existing, _ := stores.Packages.Get(ctx, pkgID)
@@ -157,16 +161,6 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 		return "skipped", nil
 	}
 
-	title, _ := manifest["title"].(string)
-	if title == "" {
-		return "", fmt.Errorf("manifest missing 'title'")
-	}
-
-	pkgType, _ := manifest["type"].(string)
-	if pkgType == "" {
-		pkgType = "surface"
-	}
-
 	// Extract static assets to packagesDir/{id}/
 	if packagesDir != "" {
 		if err := extractPackageAssets(zr, packagesDir, pkgID); err != nil {
@@ -174,17 +168,11 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 		}
 	}
 
-	// Extract manifest fields for DB columns
-	version, _ := manifest["version"].(string)
-	if version == "" {
-		version = "0.0.0"
-	}
-	description, _ := manifest["description"].(string)
-	author, _ := manifest["author"].(string)
-	tier, _ := manifest["tier"].(string)
-	if tier == "" {
-		tier = "browser"
-	}
+	// Use validated manifest fields for DB columns
+	version := mInfo.Version
+	description := mInfo.Description
+	author := mInfo.Author
+	tier := mInfo.Tier
 
 	// Register in database via Seed (upsert)
 	if err := stores.Packages.Seed(ctx, pkgID, title, "bundled", manifest); err != nil {