Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -764,6 +764,7 @@ func main() {
 			}
 			pkgAdm := handlers.NewPackageHandler(stores, packagesDir)
 			pkgAdm.SetSandbox(sandbox.New(sandbox.DefaultConfig()))
+			pkgAdm.SetBundledDir(cfg.BundledPackagesDir)
 
 			// Package registry — must be registered before /packages/:id
 			registryH := handlers.NewRegistryHandler(stores, packagesDir, pkgAdm)
@@ -867,7 +868,7 @@ func main() {
 			middleware.AuthOrRedirect(cfg, stores.Users, userCache),
 			middleware.RequireAdminPage(stores),
 		},
-		Session: middleware.AuthOrRedirect(cfg, stores.Users, userCache), // TODO: session middleware for workflow visitors
+		Session: middleware.OptionalAuth(cfg, stores.Users, userCache),
 	})
 
 	// Mounted at /s/:slug/api/* with JWT auth (returns 401, not redirect).