feat(scripts): polymorphic script owner (app XOR group) — Phase 4 foundation

Phase 4-lite C1. Make script ownership polymorphic so a script can be owned
by a GROUP (a template inherited by descendant apps) instead of an app —
mirroring vars/secrets (0048/0049), but ON DELETE RESTRICT (code is not data).

Schema (0050): `scripts.group_id` (nullable FK→groups RESTRICT), `app_id` made
nullable, `scripts_owner_exactly_one` CHECK, and the per-app name index split
into two per-owner partial-unique indexes. Existing app-owned rows keep their
exact `(app_id, lower(name))` uniqueness.

Type: `Script.app_id` becomes `Option<AppId>`; add `Script.group_id` +
`ScriptOwner` / `is_owned_by_app()`. `NewScript` gains the same polymorphic
owner. The execution-context app (what a script runs *under*) is supplied by
the invoking route/trigger/caller, never read off the script — group scripts
have no single app.

Behavior is fully preserved for app-owned scripts (the only kind creatable
today): every isolation backstop and authz site now uses `is_owned_by_app`,
which is byte-identical for app owners and **fails closed** for group owners.
A group script therefore can't yet be run, route/trigger-bound, invoked, or
managed via the app-script API — those land in C2 (group-script creation) and
C3 (chain-membership resolution + binding). The `/execute/{id}` bypass 404s a
group script (no app context to run under).

Re-blesses expected_schema.txt; note the golden was last blessed at migration
0044, so this also captures the already-committed 0045–0049 schema.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/migrations/0050_group_scripts.sql

@@ -0,0 +1,40 @@
+-- Phase 4 (v1.2 Hierarchies): group-owned scripts.
+--
+-- Until now every script was owned by exactly one app (`app_id NOT NULL`,
+-- ON DELETE RESTRICT). Phase 4 lets a script be owned by a GROUP instead, so
+-- it is shared by every descendant app — resolved by name, nearest-owner
+-- wins (CoW: an app's own script of the same name shadows the inherited one),
+-- exactly like `vars`/`secrets` (0048/0049).
+--
+-- Phase 4-LITE scope: group-owned ENDPOINT scripts only. Group modules and
+-- the origin-aware (lexical) import resolver are deferred to Phase 4b, so a
+-- group-owned script must be self-contained (enforced in the service layer).
+--
+-- Reshape (mirrors vars/secrets, but RESTRICT not CASCADE — code is not data,
+-- a group can't be deleted out from under the scripts it owns, matching the
+-- existing app_id RESTRICT and the §5.6 delete=RESTRICT rule):
+--   * `group_id` — nullable FK→groups, ON DELETE RESTRICT.
+--   * `app_id`   — made nullable (was NOT NULL); the exactly-one CHECK now
+--     enforces "owned by an app XOR a group".
+--   * the per-app unique name index becomes two partial indexes, one per owner.
+
+ALTER TABLE scripts
+    ADD COLUMN group_id UUID REFERENCES groups(id) ON DELETE RESTRICT;
+
+ALTER TABLE scripts
+    ALTER COLUMN app_id DROP NOT NULL;
+
+ALTER TABLE scripts
+    ADD CONSTRAINT scripts_owner_exactly_one
+        CHECK ((group_id IS NULL) <> (app_id IS NULL));
+
+-- Per-owner, case-insensitive name uniqueness. Partial so each owner column
+-- only constrains its own rows; existing app rows (group_id NULL) keep the
+-- exact same (app_id, LOWER(name)) uniqueness they had under the old index.
+DROP INDEX scripts_name_uidx;
+CREATE UNIQUE INDEX scripts_app_name_uidx
+    ON scripts (app_id, LOWER(name)) WHERE app_id IS NOT NULL;
+CREATE UNIQUE INDEX scripts_group_name_uidx
+    ON scripts (group_id, LOWER(name)) WHERE group_id IS NOT NULL;
+
+CREATE INDEX scripts_group_id_idx ON scripts (group_id) WHERE group_id IS NOT NULL;