test(cli): pin the group-create RBAC denial as HTTP 403

`creating_a_group_requires_group_admin_on_the_parent` asserted only that the
member's apply exited non-zero — so it would pass even with the GroupAdmin check
removed, because the apply would still fail for an unrelated reason (a 404 on the
attach-point lookup, a credential error, a 500). It now asserts the stderr carries
`HTTP 403` — specifically the authz denial — matching the rest of the RBAC suite.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/group_create.rs

@@ -174,6 +174,15 @@ fn creating_a_group_requires_group_admin_on_the_parent() {
         !out.status.success(),
         "an editor without group-admin must not create a group"
     );
+    // Pin the REASON, not just "it failed". Without this the test passes even if
+    // the GroupAdmin check is removed — the member's apply would still exit
+    // non-zero for an unrelated reason (a 404 on the attach-point lookup, a
+    // credential error, a 500). `HTTP 403` is specifically the authz denial.
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        stderr.contains("HTTP 403"),
+        "the failure must be an authz denial (HTTP 403), not an incidental error:\n{stderr}"
+    );
 
     // The group was NOT created (the tx rolled back).
     let ls = String::from_utf8(