Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/starlark_helpers.go

@@ -3,6 +3,7 @@ package handlers
 import (
 	"encoding/json"
 	"fmt"
+	"log"
 
 	"go.starlark.net/starlark"
 )
@@ -90,9 +91,13 @@ func ParseSchemaVersion(manifest any) int {
 	return 0
 }
 
-// RunSchemaMigrations runs extension schema migrations between versions.
-// Stub — full implementation will be added when extension DB schemas are stabilized.
+// RunSchemaMigrations logs a schema version change during package update.
+//
+// Only additive schema changes are supported: extensions can ADD columns and
+// tables via db_tables in the manifest, but cannot modify or delete existing
+// schema. If a migration between versions requires destructive changes,
+// uninstall and reinstall the package manually.
 func RunSchemaMigrations(ctx any, sandbox any, stores any, db any, isPostgres bool, packageID string, manifest any, fromVersion, toVersion int) error {
-	// TODO: implement extension schema migrations
+	log.Printf("[pkg-migrate] %s: schema version %d → %d (only additive changes are applied automatically; destructive migrations require manual uninstall/reinstall)", packageID, fromVersion, toVersion)
 	return nil
 }