Feat event bus subscriptions + trigger system (v0.2.2)

Three trigger primitives replacing the old monolithic scheduler:

- Event triggers: extensions subscribe to bus patterns via manifest,
  async handler invocation through sandbox.CallEntryPoint
- Webhook triggers: inbound HTTP at /api/v1/hooks/:pkg/:slug with
  HMAC-SHA256 verification and synchronous Starlark response
- Scheduled tasks: user-created cron scripts with restricted sandbox
  (no raw HTTP, no DB table creation), runs as creator identity

New tables: triggers, scheduled_tasks, trigger_logs (postgres + sqlite).
New permission: triggers.register. Full admin + user CRUD APIs.
SyncManifestTriggers hooked into seed and install flows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -52,6 +52,8 @@ type Stores struct {
 	ExtData         ExtDataStore             // v0.29.2: Extension namespaced table catalog
 	Tickets         TicketStore              // v0.32.0: WS auth tickets (PG-backed for cross-pod)
 	RateLimits      RateLimitStore           // v0.32.0: Distributed rate limiting
+	Triggers        TriggerStore             // v0.2.2: Extension event/webhook triggers
+	ScheduledTasks  ScheduledTaskStore       // v0.2.2: User-created cron tasks
 }
 
 // TeamAvailableModel is returned by CatalogStore.ListTeamAvailable.