feat(v1.1.9): InvokeService trait + InvokeTarget + ScriptRepository::get_by_name

shared/invoke.rs introduces the InvokeService trait + InvokeTarget enum:

  - InvokeTarget::Path(String)  — resolves via the route trie
  - InvokeTarget::Name(String)  — (cx.app_id, name) -> script_id via get_by_name
  - InvokeTarget::Id(ScriptId)  — direct lookup

InvokeService::resolve enforces same-app at the service layer
(InvokeError::CrossApp). InvokeService::enqueue_async writes a v1.1.9
OutboxSourceKind::Invoke row for fire-and-forget composition.

Errors: NotFound, CrossApp, DepthExceeded(u32), Forbidden, Rejected,
Unavailable. NoopInvokeService surfaces all calls as Unavailable for
harnesses that don't wire the service.

ScriptRepository gains get_by_name(app_id, name) backed by the existing
(app_id, name) uniqueness constraint. Postgres impl + in-memory mock +
the picloud crate's PostgresScriptRepoHandle delegate added.

Services::new gains invoke: Arc<dyn InvokeService> positionally after
queue. with_noop_services wires NoopInvokeService. 12 test sites
threaded through. picloud/lib.rs binds NoopInvokeService at this commit
boundary — the real InvokeResolver lands in commit 8.

Deviation from plan (flagged for HANDBACK §7): the plan called for
moving ExecutorClient + ScriptIdentity from orchestrator-core to shared
so the invoke bridge could call a re-entrant variant. Re-evaluated:
the bridge lives in executor-core which can hold Arc<Engine> directly,
making the trait move unnecessary. Engine::execute is sync, returns
ExecResponse, and shares the engine instance + per-call SdkCallCx
exactly as required. AST cache reuse across invokes is a v1.2 optimization
(invokes recompile each call — ms-scale cost, acceptable).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -274,6 +274,11 @@ pub async fn build_app(
             authz.clone(),
         ),
     );
+    // v1.1.9 function composition. Real InvokeService wired in commit 8;
+    // the noop here keeps the binary compiling — without it, scripts
+    // calling `invoke()` will throw a clear error.
+    let invoke: Arc<dyn picloud_shared::InvokeService> =
+        Arc::new(picloud_shared::NoopInvokeService);
     let services = Services::new(
         kv,
         docs,
@@ -287,6 +292,7 @@ pub async fn build_app(
         email,
         users.clone(),
         queue,
+        invoke,
     );
     let engine = Arc::new(Engine::new(Limits::default(), services));
 
@@ -595,6 +601,13 @@ impl picloud_manager_core::ScriptRepository for PostgresScriptRepoHandle {
     ) -> Result<Option<picloud_shared::Script>, picloud_manager_core::ScriptRepositoryError> {
         self.0.get(id).await
     }
+    async fn get_by_name(
+        &self,
+        app_id: picloud_shared::AppId,
+        name: &str,
+    ) -> Result<Option<picloud_shared::Script>, picloud_manager_core::ScriptRepositoryError> {
+        self.0.get_by_name(app_id, name).await
+    }
     async fn list(
         &self,
     ) -> Result<Vec<picloud_shared::Script>, picloud_manager_core::ScriptRepositoryError> {