Feat v0.3.7 package audit (#20)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -2,6 +2,84 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.3.7 — Package Audit
+
+### Added
+
+- **Dormant status**: New `dormant` value in `packages.status` CHECK constraint
+  (both Postgres and SQLite). Installer auto-detects packages with unmet
+  `requires` entries and sets `status=dormant, enabled=false`. Enable endpoint
+  returns 409 for dormant packages.
+- **Generalized requires check**: Any unmet requirement triggers dormant status,
+  not just specific values. Known capabilities checked against a whitelist;
+  anything unknown is unmet.
+- **Admin UI indicators**: Dormant badge, disabled Enable button with tooltip,
+  Dormant stat card in packages admin view.
+- **Tests**: 4 new handler tests covering dormant status, enable blocking,
+  surface exclusion, and admin list inclusion.
+
+### Fixed
+
+- **Manifest fixes**: Fixed 6 chat-extension manifests (`"name"` → `"title"`)
+  that were blocking install. Added explicit `"type": "surface"` to
+  hello-dashboard, icd-test-runner, sdk-test-runner.
+- **Dashboard + Editor tagged dormant**: Both depend on removed `sw.*`
+  imperative SDK (`sw.tabs`, `sw.chat`, `sw.layout`, etc.) — render blank.
+  Tagged with `requires: ["legacy-sdk"]` so installer auto-sets dormant.
+- **Dependency check**: Relaxed library dependency validation to allow
+  `pending_review` libraries (gitea-client declares permissions). Only
+  `suspended`/`dormant` libraries blocked.
+
+### Package Audit Results
+
+- **7 working surfaces**: schedules, tasks, team-activity-log, git-board,
+  hello-dashboard, icd-test-runner, sdk-test-runner
+- **8 dormant**: 6 chat-dependent (csv-table, diff-viewer, js-sandbox,
+  katex-renderer, mermaid-renderer, regex-tester) + 2 legacy-sdk (dashboard,
+  editor)
+- **1 library**: gitea-client (standalone, active)
+
+## v0.3.6 — Example Workflows + Interactive Demo
+
+### Added
+
+- **Bug Report Triage** (`packages/bug-report-triage`): Public entry, progressive
+  fieldsets, severity-based branch routing, SLA timer (3600s on critical fix).
+- **Employee Onboarding** (`packages/employee-onboarding`): Starlark automated
+  stages (`db.insert`, `notifications.send`), manager signoff gate with
+  `required_role`, rejection reroute. `script.star` with `on_provision` and
+  `on_welcome` hooks. Creates `provisions` and `onboarding_log` ext_data tables.
+- **Content Approval** (`packages/content-approval`): Multi-party signoff (quorum
+  of 2), rejection reroute creating a review cycle loop.
+- **Webhook Notifier** (`packages/webhook-notifier`): Starlark `http.post` with
+  `connections.get` fallback, delivery logging to `webhook_log` ext_data table.
+- **Workflow Demo** surface (`packages/workflow-demo`): Interactive walkthrough
+  with workflow cards, stage flow diagrams, Starlark viewer, API curl examples,
+  and "Try It" buttons. Route: `/s/workflow-demo`.
+- **Engine context fix**: `started_by` added to automated stage Starlark context
+  dict, enabling hooks to reference the workflow initiator.
+- **SLA package installer**: `sla_seconds` field added to `workflowPkgStage`
+  struct and wired in both install and export paths.
+- **Snapshot format fix**: `parseSnapshotStages` helper handles both wrapped
+  (`{"stages":[...]}`) and legacy flat array snapshot formats in the engine,
+  fixing `corrupt version snapshot` errors when starting published workflows.
+- **Workflow adoption**: `POST /teams/:teamId/workflows/:id/adopt` claims a
+  global (team_id=NULL) workflow for a team. `GET /teams/:teamId/workflows/available`
+  lists adoptable workflows. `TeamID` added to `WorkflowPatch` model.
+- **Tests**: 3 new engine tests (automated context, SLA install, manifest
+  roundtrip). Total: 142 handler tests passing.
+- Per-package `README.md` files for all 5 new packages.
+
+### Fixed
+
+- **Demo surface**: Added `sw.userMenu` to topbar. Fixed workflow install
+  detection (was reading wrong response key). CSS uses theme variables for
+  dark mode support.
+- **Admin teams tab**: Extracted `.data` from paginated response — was stuck
+  at loading because `setTeams` received the envelope object, not the array.
+- **Team-admin workflows**: Added "Adopt Global" button to claim package-installed
+  workflows into a team scope. Workflow list now unwraps paginated responses.
+
 ## v0.3.5 — Settings Audit + ICD + Tests + Clone
 
 ### Added