test(v1.1.3-modules): resolver, cache, validator, kind-rejection coverage

Adds ~46 new tests across the v1.1.3 surface:

executor-core/tests/modules.rs (NEW, 23 tests):
- resolver_loads_simple_module / endpoint_can_import_module /
  module_can_import_module — end-to-end through Engine::execute.
- resolver_cross_app_blocked / resolver_cross_app_module_not_found /
  module_cache_keyed_by_app — same-name modules in different apps
  resolve independently; cross-app lookup returns ModuleNotFound.
- resolver_self_import_detected / resolver_circular_detected —
  cycle detector reports the chain.
- resolver_depth_limit_enforced / resolver_depth_limit_just_under_succeeds.
- resolver_module_not_found / resolver_backend_error_surfaces.
- resolver_runtime_validation_rejects_top_level_expr — defense-in-
  depth: a module with a top-level expression that bypassed the
  admin gate is rejected at resolve time.
- module_cache_hit_reuses_compiled_module /
  module_cache_stale_invalidated_on_updated_at_change /
  module_cache_lru_evicts_when_capacity_exceeded.
- validate_module_{accepts_fn_const_import_only,
  rejects_top_level_let, rejects_top_level_expr,
  rejects_top_level_while}.
- validate_endpoint_{extracts_literal_imports,
  top_level_expr_still_allowed,
  skips_dynamic_imports_in_imports_list}.

orchestrator-core/src/client.rs cache_tests (6 tests):
- cache_hit_when_identity_matches / cache_invalidated_when_updated_at_changes
  / distinct_script_ids_cache_independently / lru_eviction_caps_cache_size
  / script_identity_is_copy / compile_error_does_not_poison_cache.

shared/src/script.rs kind_tests (3 tests):
- default_is_endpoint / round_trips_through_serde_lowercase
  / parse_str_round_trip.

manager-core/src/triggers_api.rs v1.1.3 tests (6 tests):
- kv_trigger_rejects_module_target / docs_trigger_rejects_module_target
  / dl_trigger_rejects_module_target — modules cannot be trigger
  targets.
- kv_trigger_rejects_missing_script / kv_trigger_rejects_cross_app_script
  — closes the latent v1.1.1/v1.1.2 isolation gap.
- kv_trigger_accepts_endpoint_target — happy path through the
  validate_trigger_target check.

picloud/tests/api.rs (8 #[ignore]'d Postgres-gated integration tests):
- create_script_default_kind_is_endpoint / create_module_kind_persists.
- create_module_with_top_level_expr_rejected /
  create_module_with_reserved_name_rejected.
- route_bind_rejects_module.
- endpoint_imports_module_end_to_end /
  module_edit_visible_on_next_invocation / cross_app_import_blocked.

Lint cleanup along the way:
- `ScriptKind::from_str` renamed to `parse_str` to dodge the
  `should_implement_trait` lint (FromStr's `Result<…,Err>` shape
  doesn't fit a 0-info lookup).
- `derive(Default)` on `ScriptKind` (Endpoint marked `#[default]`).
- Match-arm collapse in `check_module_shape` for Import + Noop.
- `#[allow(clippy::too_many_lines)]` on `resolve()` (the bridge
  logic is genuinely cohesive and would lose clarity if split).
- Elided `'r` lifetime on `StackGuard`.

Three gates clean on this commit's HEAD:
- cargo fmt --all -- --check: clean
- cargo clippy --all-targets --all-features -- -D warnings: clean
- cargo test --workspace: 358 passed, 140 ignored (Postgres-gated)
- npm run check: 0 errors, 0 warnings

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/script.rs

@@ -14,21 +14,16 @@ use crate::{AppId, ScriptId, ScriptSandbox};
 /// Serialized as `"endpoint"` / `"module"` so the wire shape is the
 /// same string the SQL `CHECK (kind IN ('endpoint','module'))`
 /// constraint enforces.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 pub enum ScriptKind {
+    #[default]
     Endpoint,
     Module,
 }
 
-impl Default for ScriptKind {
-    fn default() -> Self {
-        Self::Endpoint
-    }
-}
-
 impl ScriptKind {
-    /// Wire / SQL representation. Inverse of `from_str`.
+    /// Wire / SQL representation. Inverse of `parse_str`.
     #[must_use]
     pub fn as_str(self) -> &'static str {
         match self {
@@ -39,8 +34,11 @@ impl ScriptKind {
 
     /// Parse the canonical wire / SQL form. Returns `None` for any
     /// other input; callers map that to a 400 / `ValidationError`.
+    /// Named `parse_str` (not `from_str`) to dodge the
+    /// `std::str::FromStr` lint without taking on the trait's
+    /// `Result<Self, Self::Err>` shape that this caller doesn't need.
     #[must_use]
-    pub fn from_str(s: &str) -> Option<Self> {
+    pub fn parse_str(s: &str) -> Option<Self> {
         match s {
             "endpoint" => Some(Self::Endpoint),
             "module" => Some(Self::Module),
@@ -49,6 +47,45 @@ impl ScriptKind {
     }
 }
 
+#[cfg(test)]
+mod kind_tests {
+    use super::*;
+
+    #[test]
+    fn default_is_endpoint() {
+        assert_eq!(ScriptKind::default(), ScriptKind::Endpoint);
+    }
+
+    #[test]
+    fn round_trips_through_serde_lowercase() {
+        assert_eq!(
+            serde_json::to_string(&ScriptKind::Endpoint).unwrap(),
+            "\"endpoint\""
+        );
+        assert_eq!(
+            serde_json::to_string(&ScriptKind::Module).unwrap(),
+            "\"module\""
+        );
+        assert_eq!(
+            serde_json::from_str::<ScriptKind>("\"endpoint\"").unwrap(),
+            ScriptKind::Endpoint
+        );
+        assert_eq!(
+            serde_json::from_str::<ScriptKind>("\"module\"").unwrap(),
+            ScriptKind::Module
+        );
+    }
+
+    #[test]
+    fn parse_str_round_trip() {
+        for k in [ScriptKind::Endpoint, ScriptKind::Module] {
+            assert_eq!(ScriptKind::parse_str(k.as_str()), Some(k));
+        }
+        assert_eq!(ScriptKind::parse_str("invalid"), None);
+        assert_eq!(ScriptKind::parse_str(""), None);
+    }
+}
+
 /// A user-uploaded Rhai script and its execution configuration.
 ///
 /// This is the canonical representation that flows between manager (storage),

crates/shared/src/services.rs

@@ -20,8 +20,8 @@
 use std::sync::Arc;
 
 use crate::{
-    DeadLetterService, DocsService, KvService, ModuleSource, NoopDeadLetterService, NoopDocsService,
-    NoopEventEmitter, NoopKvService, NoopModuleSource, ServiceEventEmitter,
+    DeadLetterService, DocsService, KvService, ModuleSource, NoopDeadLetterService,
+    NoopDocsService, NoopEventEmitter, NoopKvService, NoopModuleSource, ServiceEventEmitter,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x