[codex] Add teams catalog extraction (#7550)

Fixes #7551

## Thinking Path

> - Paperclip is the control plane for AI-agent companies, and reusable
company/team setup is part of making those companies faster to launch.
> - The teams catalog work introduces app-shipped team templates that
can be browsed, previewed, and installed into a company.
> - Catalog installation crosses several contracts: bundled package
contents, shared API types, server import/install behavior, CLI
workflows, and the board UI.
> - Agents also need a safe path through catalog installs: scoped
company selection, explicit source policy, approval fallback for agent
creation, and preserved catalog provenance.
> - This pull request extracts the completed teams catalog branch into
one reviewable PR on top of `public-gh/master`.
> - The benefit is a reusable teams catalog foundation with server, CLI,
package, docs, and hidden UI surfaces kept in sync.

## What Changed

- Added the `@paperclipai/teams-catalog` package with bundled/optional
team definitions, generated manifest, validators, catalog builder tests,
and migration notes.
- Added shared teams catalog types/validators plus server routes and
services for listing, previewing, and installing catalog teams.
- Integrated catalog install with company portability, skill/source
policy checks, provenance metadata, origin hashes, target-manager
reparenting, and installed/out-of-date detection.
- Added CLI `teams` commands and agent-safe company selection behavior,
including `company current` and approval fallback for forbidden
agent-run installs.
- Added hidden Team Catalog UI/API/query surfaces, Storybook fixtures,
and targeted UI tests while keeping the UI route out of primary
navigation.
- Added docs for CLI/company/teams catalog behavior and removed
generated screenshot artifacts from the PR diff.

## Verification

- `pnpm exec vitest run cli/src/__tests__/company.test.ts
cli/src/__tests__/teams.test.ts
packages/teams-catalog/src/catalog-builder.test.ts
packages/teams-catalog/src/shipped-catalog.test.ts
server/src/__tests__/agent-permissions-service.test.ts
server/src/__tests__/company-portability.test.ts
server/src/__tests__/company-skills-service.test.ts
server/src/__tests__/teams-catalog-routes.test.ts
server/src/__tests__/teams-catalog-service.test.ts
server/src/__tests__/teams-catalog-install-no-overrides.test.ts
ui/src/lib/company-routes.test.ts ui/src/pages/TeamCard.test.tsx
ui/src/pages/TeamCatalog.test.tsx
ui/src/pages/useInstallTeamCatalogEntry.test.tsx`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/teams-catalog typecheck && pnpm --filter paperclipai
typecheck && pnpm --filter @paperclipai/server typecheck && pnpm
--filter @paperclipai/ui typecheck`
- Confirmed branch is rebased onto `public-gh/master` (`78dc3625a`) and
`public-gh/master` is an ancestor of `HEAD`.
- Confirmed PR diff excludes `pnpm-lock.yaml`, `.github/workflows/*`,
generated screenshot images, and screenshot helper scripts.

## Risks

- Medium review surface: this crosses package generation, shared
contracts, server install behavior, CLI, docs, and hidden UI code.
- Catalog install behavior creates agents/projects/tasks/skills and must
keep company scoping, permissions, source policy, and provenance checks
strict.
- `pnpm-lock.yaml` is intentionally excluded per repo policy;
CI/default-branch automation owns lockfile refresh.
- The Team Catalog UI is included but hidden from primary navigation, so
future enablement should re-check visual QA before exposure.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
>
> ROADMAP checked: this aligns with reusable companies/templates and
plugin-adjacent onboarding work. This PR packages work already developed
on the Paperclip task branch for review.

## Model Used

- OpenAI Codex, GPT-5 series coding agent in this Paperclip session;
exact runtime context window was not exposed. Used shell, git, `gh`, and
local test/typecheck tooling.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots, or documented why screenshots are intentionally omitted
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

ui/src/api/teamCatalog.ts

@@ -0,0 +1,57 @@
+import type {
+  CatalogTeam,
+  CatalogTeamFileDetail,
+  CatalogTeamImportOptions,
+  CatalogTeamImportPreviewResult,
+  CatalogTeamInstallOptions,
+  CatalogTeamInstallResult,
+  CatalogTeamKind,
+  InstalledCatalogTeam,
+} from "@paperclipai/shared";
+import { api } from "./client";
+
+export interface TeamCatalogListQuery {
+  kind?: CatalogTeamKind;
+  category?: string;
+  q?: string;
+}
+
+/**
+ * Client for the Phase E teams-catalog API (server/src/routes/teams-catalog.ts).
+ *
+ * The preview/install bodies mirror `catalogTeamPreviewSchema` /
+ * `catalogTeamInstallSchema` exactly. Several richer fields the Phase F design
+ * imagined (per-source policy maps, skill-plan overrides) are not
+ * accepted by the shipped strict schema, so the UI derives those affordances
+ * client-side and degrades gracefully — see TeamCatalog.tsx.
+ */
+export const teamCatalogApi = {
+  catalogList: (query: TeamCatalogListQuery = {}) => {
+    const params = new URLSearchParams();
+    if (query.kind) params.set("kind", query.kind);
+    if (query.category) params.set("category", query.category);
+    if (query.q) params.set("q", query.q);
+    const search = params.toString();
+    return api.get<CatalogTeam[]>(`/teams/catalog${search ? `?${search}` : ""}`);
+  },
+  catalogDetail: (catalogRef: string) =>
+    api.get<CatalogTeam>(`/teams/catalog/${encodeURIComponent(catalogRef)}`),
+  installed: (companyId: string) =>
+    api.get<InstalledCatalogTeam[]>(
+      `/companies/${encodeURIComponent(companyId)}/teams/catalog/installed`,
+    ),
+  catalogFile: (catalogRef: string, relativePath = "TEAM.md") =>
+    api.get<CatalogTeamFileDetail>(
+      `/teams/catalog/${encodeURIComponent(catalogRef)}/files?path=${encodeURIComponent(relativePath)}`,
+    ),
+  preview: (companyId: string, catalogRef: string, options: CatalogTeamImportOptions = {}) =>
+    api.post<CatalogTeamImportPreviewResult>(
+      `/companies/${encodeURIComponent(companyId)}/teams/catalog/${encodeURIComponent(catalogRef)}/preview`,
+      options,
+    ),
+  install: (companyId: string, catalogRef: string, options: CatalogTeamInstallOptions = {}) =>
+    api.post<CatalogTeamInstallResult>(
+      `/companies/${encodeURIComponent(companyId)}/teams/catalog/${encodeURIComponent(catalogRef)}/install`,
+      options,
+    ),
+};