Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/js/sw/surfaces/admin/health.js

@@ -48,10 +48,12 @@ function formatNum(v) {
 
 // ── Stat card ───────────────────────────────────
 
-function Stat({ label, value }) {
+function Stat({ label, value, hint }) {
     return html`
-        <div style="padding:8px 12px;background:var(--bg-secondary, #f5f5f5);border-radius:6px;min-width:120px;">
-            <div style="font-size:11px;color:var(--text-muted, #888);margin-bottom:2px;">${label}</div>
+        <div style="padding:8px 12px;background:var(--bg-secondary, #f5f5f5);border-radius:6px;min-width:120px;" title=${hint || ''}>
+            <div style="font-size:11px;color:var(--text-muted, #888);margin-bottom:2px;">
+                ${label}${hint ? html`<span style="margin-left:3px;cursor:help;opacity:0.5;" title=${hint}>\u24D8</span>` : ''}
+            </div>
             <div style="font-size:16px;font-weight:600;font-variant-numeric:tabular-nums;">${value}</div>
         </div>
     `;
@@ -148,8 +150,8 @@ function ExtensionPanel({ m }) {
                 <${Stat} label="Starlark Errors"   value=${formatNum(m.starlark_errors_total)} />
                 <${Stat} label="Avg Duration"       value=${formatMs(m.starlark_avg_duration_ms)} />
                 <${Stat} label="Trigger Fires"     value=${formatNum(m.trigger_fires_total)} />
-                <${Stat} label="Events Published"  value=${formatNum(m.event_bus_published)} />
-                <${Stat} label="Events Delivered"  value=${formatNum(m.event_bus_delivered)} />
+                <${Stat} label="Events Published"  value=${formatNum(m.event_bus_published)} hint="Total events emitted by the event bus. Not all events have active subscribers \u2014 published > delivered is normal (e.g. startup events fire before any clients connect)." />
+                <${Stat} label="Events Delivered"  value=${formatNum(m.event_bus_delivered)} hint="Events that matched at least one subscriber and were dispatched. Lower than published when events fire with no listeners (e.g. during startup)." />
             </div>
         </div>
     `;