Feat event bus subscriptions + trigger system (v0.2.2)

Three trigger primitives replacing the old monolithic scheduler:

- Event triggers: extensions subscribe to bus patterns via manifest,
  async handler invocation through sandbox.CallEntryPoint
- Webhook triggers: inbound HTTP at /api/v1/hooks/:pkg/:slug with
  HMAC-SHA256 verification and synchronous Starlark response
- Scheduled tasks: user-created cron scripts with restricted sandbox
  (no raw HTTP, no DB table creation), runs as creator identity

New tables: triggers, scheduled_tasks, trigger_logs (postgres + sqlite).
New permission: triggers.register. Full admin + user CRUD APIs.
SyncManifestTriggers hooked into seed and install flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/seed_packages.go

@@ -138,6 +138,8 @@ func SeedBuiltinPackages(stores store.Stores, extensionsDir string) {
 				log.Printf("⚠ Failed to update builtin package %s: %v", manifest.ID, err)
 				continue
 			}
+			// Sync triggers on version update (v0.2.2)
+			SyncManifestTriggers(ctx, stores, nil, manifest.ID, manifestMap)
 			updated++
 			continue
 		}
@@ -167,6 +169,9 @@ func SeedBuiltinPackages(stores store.Stores, extensionsDir string) {
 		if err := stores.Packages.Update(ctx, manifest.ID, pkg); err != nil {
 			log.Printf("⚠ Failed to update builtin package metadata %s: %v", manifest.ID, err)
 		}
+		// Sync triggers from manifest (v0.2.2)
+		SyncManifestTriggers(ctx, stores, nil, manifest.ID, manifestMap)
+
 		seeded++
 	}