Feat v0.9.0 multi-surface packages (#73)

Packages can declare a `surfaces` array with per-path access controls,
titles, and layouts. A single package can serve a public form, an
authenticated dashboard, and an admin page — each with independent
access enforcement.

Kernel:
- Manifest validation for surfaces array (path, access, duplicates)
- Auto-synthesis from legacy auth/layout for existing packages
- Unified /s/:slug route tree (RegisterExtensionRoutes) dispatches
  between surface rendering and ext API calls
- matchSurface() with Gin-style :param support and specificity ordering
- evaluateAccess() for per-surface access checks
- Nav filters out pending_review packages (pre-existing bug fix)

Frontend:
- __SURFACE_PATH__ and __SURFACE_PARAMS__ template injection
- sw.navigate(path, params) for SPA-style intra-package routing
- surface.navigate event + popstate handling
- SDK version bumped to 0.9.0

Docs:
- MULTI-SURFACE-GUIDE.md — full developer guide
- PACKAGE-FORMAT.md — surfaces field reference
- CHANGELOG.md, ROADMAP.md updated

22 new tests (11 manifest validation, 11 route matching/nav).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -75,70 +75,70 @@ All completed work is documented in `CHANGELOG.md`.
 
 ## Planned
 
-### v0.9.x — Workflow Redesign
+### v0.9.x — Multi-Surface Packages + Workflow Redesign
+
+**v0.9.0 — Multi-Surface Packages** *(completed)*
+
+Packages declare a `surfaces` array with per-path access controls,
+titles, and layouts. Unified route tree dispatches between surface
+rendering and ext API calls. `sw.navigate()` for client-side sub-path
+routing. Design doc: `docs/DESIGN-multi-surface.md`.
+
+**v0.9.1 — Server-Side Sub-Path Routing**
+
+Full-page refresh on sub-paths (e.g. `/s/my-pkg/monitor`) currently
+requires client-side routing. This version restructures the Gin route
+tree so the kernel resolves sub-paths server-side, including proper
+`OptionalAuth` for packages with mixed public/authenticated surfaces.
+
+**v0.9.2 — Starlark Converter Consolidation + Snapshot Cleanup**
 
 Design doc: `docs/DESIGN-workflow-redesign.md`
 
-The workflow system (~7,600 lines, 25+ files) was built incrementally and
-has accumulated redundant concepts, buried primitives, and a read-only
-Starlark module. This series cleans up the debt and promotes reusable
-primitives before building reference extensions on top.
-
-**v0.9.0 — Starlark Converter Consolidation + Snapshot Cleanup**
-
 Three files contain near-identical Go↔Starlark converters; three copies
 of the snapshot parser exist. Consolidate into `sandbox/convert.go` and
 one exported snapshot function. Standardize on wrapped snapshot format.
 
-**v0.9.1 — Team User Roles**
+**v0.9.3 — Team User Roles**
 
 Promote the buried role system to a kernel primitive. New
 `team_user_roles` table (many-to-many). Manifest `requires_roles` field.
 Team admin UI for role assignment. Kernel middleware `RequireRole()`.
 Starlark SDK: `teams.get_member_roles()`, `teams.has_role()`.
 
-**v0.9.2 — Package Adoption + Roles**
+**v0.9.4 — Package Adoption + Roles**
 
 `scope: adoptable` manifest field. When a team adopts an adoptable
 package, the package's `requires_roles` auto-populate into the team's
 role slots. Replaces `AdoptTeamWorkflow` clone mechanism.
 
-**v0.9.3 — Typed Forms → SDK Primitive**
+**v0.9.5 — Typed Forms → SDK Primitive**
 
 Extract `TypedFormTemplate`, `FormField`, `FormFieldset`, etc. from
 `models/workflow.go` into a `forms` package. FE SDK: `sw.forms.render()`
 and `sw.forms.validate()`. Starlark: `forms.validate()`. Any package
 can declare forms, not just workflow stages.
 
-**v0.9.4 — Deprecate `stage_type`, Collapse `stage_mode`**
+**v0.9.6 — Deprecate `stage_type`, Collapse `stage_mode`**
 
 `stage_type` (simple/dynamic/automated) is redundant with `starlark_hook`
 presence. Remove from new manifests, keep parsing for backward compat.
 Collapse `stage_mode` from 4 to 3 values: form / delegated / automated.
-`review` was just `delegated` with signoff — signoff is independent of
-rendering mode.
 
-**v0.9.5 — Full Read/Write Workflow Starlark Module**
+**v0.9.7 — Full Read/Write Workflow Starlark Module**
 
 Add `workflow.start()`, `workflow.advance()`, `workflow.cancel()`,
 `workflow.submit_signoff()` to the Starlark module. Extract engine
-interface to break circular import. Unlocks fully automated workflow
-orchestration from Starlark hooks and extensions.
+interface to break circular import.
 
-**v0.9.6 — Conditional Routing → SDK Primitive**
+**v0.9.8 — Conditional Routing → SDK Primitive**
 
 Expose `routing.evaluate(rules, data)` as a Starlark SDK function.
 Branch rules become a reusable decision engine for any extension.
 
-**v0.9.7 — Multi-Surface Manifest + Route Resolution**
+**v0.9.9 — Surface Access via Roles**
 
-Packages can declare multiple surface routes with independent access
-controls. Kernel resolves routes per-page. Enables mixed public/auth
-pages in a single package.
-
-**v0.9.8 — Surface Access via Roles**
-
-Wire team roles (v0.9.1) into surface access declarations:
+Wire team roles (v0.9.3) into surface access declarations:
 `access: role:approver`. Kernel middleware checks role membership.
 Completes the workflow→package access story.