feat(scripts): polymorphic script owner (app XOR group) — Phase 4 foundation

Phase 4-lite C1. Make script ownership polymorphic so a script can be owned
by a GROUP (a template inherited by descendant apps) instead of an app —
mirroring vars/secrets (0048/0049), but ON DELETE RESTRICT (code is not data).

Schema (0050): `scripts.group_id` (nullable FK→groups RESTRICT), `app_id` made
nullable, `scripts_owner_exactly_one` CHECK, and the per-app name index split
into two per-owner partial-unique indexes. Existing app-owned rows keep their
exact `(app_id, lower(name))` uniqueness.

Type: `Script.app_id` becomes `Option<AppId>`; add `Script.group_id` +
`ScriptOwner` / `is_owned_by_app()`. `NewScript` gains the same polymorphic
owner. The execution-context app (what a script runs *under*) is supplied by
the invoking route/trigger/caller, never read off the script — group scripts
have no single app.

Behavior is fully preserved for app-owned scripts (the only kind creatable
today): every isolation backstop and authz site now uses `is_owned_by_app`,
which is byte-identical for app owners and **fails closed** for group owners.
A group script therefore can't yet be run, route/trigger-bound, invoked, or
managed via the app-script API — those land in C2 (group-script creation) and
C3 (chain-membership resolution + binding). The `/execute/{id}` bypass 404s a
group script (no app context to run under).

Re-blesses expected_schema.txt; note the golden was last blessed at migration
0044, so this also captures the already-committed 0045–0049 schema.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/route_admin.rs

@@ -148,10 +148,16 @@ async fn list_routes<RR: RouteRepository, SR: ScriptRepository>(
         .get(script_id)
         .await?
         .ok_or(RouteApiError::ScriptNotFound(script_id))?;
+    // Phase 4: routes bind to app-owned scripts; a group-owned script
+    // (`app_id: None`) is not addressable here (binding lands in C3), so it
+    // reads as a missing script.
+    let app_id = script
+        .app_id
+        .ok_or(RouteApiError::ScriptNotFound(script_id))?;
     require(
         state.authz.as_ref(),
         &principal,
-        Capability::AppRead(script.app_id),
+        Capability::AppRead(app_id),
     )
     .await?;
     Ok(Json(state.routes.list_for_script(script_id).await?))
@@ -176,7 +182,11 @@ async fn create_route<RR: RouteRepository, SR: ScriptRepository>(
         .get(script_id)
         .await?
         .ok_or(RouteApiError::ScriptNotFound(script_id))?;
-    let app_id = script.app_id;
+    // Phase 4: only app-owned scripts are route-bindable for now (group
+    // binding is C3); a group script reads as missing here.
+    let app_id = script
+        .app_id
+        .ok_or(RouteApiError::ScriptNotFound(script_id))?;
     require(
         state.authz.as_ref(),
         &principal,