Feat event bus subscriptions + trigger system (v0.2.2)

Three trigger primitives replacing the old monolithic scheduler:

- Event triggers: extensions subscribe to bus patterns via manifest,
  async handler invocation through sandbox.CallEntryPoint
- Webhook triggers: inbound HTTP at /api/v1/hooks/:pkg/:slug with
  HMAC-SHA256 verification and synchronous Starlark response
- Scheduled tasks: user-created cron scripts with restricted sandbox
  (no raw HTTP, no DB table creation), runs as creator identity

New tables: triggers, scheduled_tasks, trigger_logs (postgres + sqlite).
New permission: triggers.register. Full admin + user CRUD APIs.
SyncManifestTriggers hooked into seed and install flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,7 +2,43 @@
 
 All notable changes to Switchboard Core are documented here.
 
-## [Unreleased] — v0.2.1
+## [Unreleased] — v0.2.2
+
+### Added
+
+- **Event bus subscriptions**: Extensions declare event triggers in manifest
+  (`"triggers": [{"type": "event", "pattern": "workflow.completed", ...}]`).
+  Wired via `bus.Subscribe()` on startup. Handlers fire asynchronously.
+- **Webhook triggers**: Inbound HTTP at `/api/v1/hooks/:package_id/:slug`.
+  HMAC-SHA256 verification via `X-Switchboard-Signature` header. Synchronous
+  Starlark handler can return custom HTTP status and body.
+- **Scheduled tasks**: User-created cron-scheduled Starlark scripts with
+  restricted sandbox (no raw HTTP, no DB table creation, connections-only
+  outbound). Runs as creator identity with RBAC scoping. Admin-created tasks
+  can opt into system context. Creator deactivation auto-pauses schedule.
+- **Schedule templates**: Extensions ship pre-built schedule templates in
+  manifest (`schedule_templates` array) with configurable params and default
+  cron expressions.
+- `triggers.register` extension permission — required for event/webhook triggers
+- `triggers` table — extension-declared event and webhook trigger definitions
+- `scheduled_tasks` table — user-created cron tasks with script, template,
+  and identity fields
+- `trigger_logs` table — unified execution audit log for both tiers
+- `TriggerStore` + `ScheduledTaskStore` interfaces (postgres + sqlite)
+- Trigger engine (`server/triggers/`) — orchestrates event subscriptions,
+  webhook resolution, and cron scheduling via `robfig/cron/v3`
+- `SyncManifestTriggers()` — declarative sync of event/webhook triggers from
+  manifest. Hooked into seed, admin install, and package install flows.
+- Admin trigger API: `GET/PUT/DELETE /admin/triggers`, `/admin/triggers/:id/logs`,
+  `/admin/packages/:id/triggers`
+- Admin schedule API: `GET /admin/schedules`, enable/disable/delete
+- User schedule API: full CRUD at `/api/v1/schedules`, manual run, execution logs
+- `trigger.fired` and `trigger.error` event bus labels (DirLocal) for observability
+- OpenAPI spec: Trigger, ScheduledTask, TriggerLog schemas + all new endpoints
+
+---
+
+## [v0.2.1] — 2026-03-26
 
 ### Added