feat(v1.1.9): InvokeService trait + InvokeTarget + ScriptRepository::get_by_name

shared/invoke.rs introduces the InvokeService trait + InvokeTarget enum:

  - InvokeTarget::Path(String)  — resolves via the route trie
  - InvokeTarget::Name(String)  — (cx.app_id, name) -> script_id via get_by_name
  - InvokeTarget::Id(ScriptId)  — direct lookup

InvokeService::resolve enforces same-app at the service layer
(InvokeError::CrossApp). InvokeService::enqueue_async writes a v1.1.9
OutboxSourceKind::Invoke row for fire-and-forget composition.

Errors: NotFound, CrossApp, DepthExceeded(u32), Forbidden, Rejected,
Unavailable. NoopInvokeService surfaces all calls as Unavailable for
harnesses that don't wire the service.

ScriptRepository gains get_by_name(app_id, name) backed by the existing
(app_id, name) uniqueness constraint. Postgres impl + in-memory mock +
the picloud crate's PostgresScriptRepoHandle delegate added.

Services::new gains invoke: Arc<dyn InvokeService> positionally after
queue. with_noop_services wires NoopInvokeService. 12 test sites
threaded through. picloud/lib.rs binds NoopInvokeService at this commit
boundary — the real InvokeResolver lands in commit 8.

Deviation from plan (flagged for HANDBACK §7): the plan called for
moving ExecutorClient + ScriptIdentity from orchestrator-core to shared
so the invoke bridge could call a re-entrant variant. Re-evaluated:
the bridge lives in executor-core which can hold Arc<Engine> directly,
making the trait move unnecessary. Engine::execute is sync, returns
ExecResponse, and shares the engine instance + per-call SdkCallCx
exactly as required. AST cache reuse across invokes is a v1.2 optimization
(invokes recompile each call — ms-scale cost, acceptable).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -20,11 +20,11 @@
 use std::sync::Arc;
 
 use crate::{
-    DeadLetterService, DocsService, EmailService, FilesService, HttpService, KvService,
-    ModuleSource, NoopDeadLetterService, NoopDocsService, NoopEmailService, NoopEventEmitter,
-    NoopFilesService, NoopHttpService, NoopKvService, NoopModuleSource, NoopPubsubService,
-    NoopQueueService, NoopSecretsService, NoopUsersService, PubsubService, QueueService,
-    SecretsService, ServiceEventEmitter, UsersService,
+    DeadLetterService, DocsService, EmailService, FilesService, HttpService, InvokeService,
+    KvService, ModuleSource, NoopDeadLetterService, NoopDocsService, NoopEmailService,
+    NoopEventEmitter, NoopFilesService, NoopHttpService, NoopInvokeService, NoopKvService,
+    NoopModuleSource, NoopPubsubService, NoopQueueService, NoopSecretsService, NoopUsersService,
+    PubsubService, QueueService, SecretsService, ServiceEventEmitter, UsersService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -102,6 +102,11 @@ pub struct Services {
     /// touch queues. Consumers register via `queue:receive` triggers
     /// (one per `(app_id, queue_name)`).
     pub queue: Arc<dyn QueueService>,
+
+    /// Same-app function composition (v1.1.9). Backs `invoke()` (sync)
+    /// and `invoke_async()` (fire-and-forget through the outbox).
+    /// Cross-app invokes are rejected at the service entry point.
+    pub invoke: Arc<dyn InvokeService>,
 }
 
 impl Services {
@@ -123,6 +128,7 @@ impl Services {
         email: Arc<dyn EmailService>,
         users: Arc<dyn UsersService>,
         queue: Arc<dyn QueueService>,
+        invoke: Arc<dyn InvokeService>,
     ) -> Self {
         Self {
             kv,
@@ -137,6 +143,7 @@ impl Services {
             email,
             users,
             queue,
+            invoke,
         }
     }
 
@@ -160,6 +167,7 @@ impl Services {
             Arc::new(NoopEmailService),
             Arc::new(NoopUsersService),
             Arc::new(NoopQueueService),
+            Arc::new(NoopInvokeService),
         )
     }
 }