feat: E2E #2 (Stash) gap remediation + S6 hardening

Closes the gaps and the one security finding from the second end-to-end
CLI test (E2E_STASH_REPORT.md), plus the H1 boot-regression found while
re-reviewing those fixes.

Security
- S6: reserved-path validation (`check_reserved`) now case-folds before
  comparing, so `/API/v2/x`, `/HEALTHZ`, `/Admin/x` are rejected like
  their lowercase forms. Request-time matching stays case-sensitive.
- S10: "public route != public data" callout in sdk-shape.md (script_gate
  skips authz when the principal is anonymous).

Observability / features
- G1: trigger executions now write `execution_logs`. Migration 0043 adds
  a `source` column (CHECK mirrors ExecutionSource/OutboxSourceKind,
  DEFAULT 'http' backfills history); a shared `build_execution_log` helper
  in executor-core; dispatcher logging for outbox triggers + queue
  consumers (skips sync-HTTP rows the orchestrator already logs). `pic
  logs` gains a source column + `--source` filter.
- G5: dev-only in-memory email capture under PICLOUD_DEV_MODE with no SMTP
  (email::send succeeds locally), readable at GET /api/v1/admin/dev/emails
  (Owner/Admin only; route mounted only in capture mode).
- G6: generalized the Rhai in-place-mutation footgun note (trim/replace/
  make_upper/make_lower/crop/truncate/pad return ()).
- G2/G3/G4 (CLI): `pic members`, `pic files`, `pic queues`, read-only
  `pic kv` (+ new kv_api.rs); `pic deploy --timeout/--memory/--kind/
  --sandbox`; first-class `pic triggers create-{docs,files,pubsub,queue,
  email}` wrappers. All new client path segments percent-encoded via seg().

H1 regression fix (found in re-review)
- The S6 change also runs in `compile_routes`, which compiles every stored
  route at boot and on each route CRUD. A single stored route the new
  validation rejects (creatable while the S6 gap existed) made the whole
  compile Err and aborted startup. `compile_routes` is now lenient: it
  skips an un-compilable row with a warning instead of bricking boot
  (route creation still validates separately). Migration 0044 sweeps
  pre-existing reserved-path routes on upgrade (WHERE mirrors
  check_reserved exactly). Added regression tests for both.

Verified: cargo fmt, clippy --all-targets --all-features -D warnings, the
schema_snapshot test, and the new S6/lenient-compile unit tests all pass;
boot-resilience and G1/G5 confirmed live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/sdk-shape.md

@@ -122,6 +122,18 @@ unauthenticated by default — public HTTP scripts run with `None`.
 Services that need an authenticated identity (e.g., `users::*`) check
 `cx.principal.is_some()` and throw if missing.
 
+> **A public route ≠ public *data*.** When a route is unauthenticated,
+> the script runs with `principal: None`, and the capability gate
+> (`authz::script_gate`) returns `Ok` immediately — the script holds
+> **full app authority**. It can read and write *all* of the app's
+> `kv`, `docs`, `files`, `secrets`, `queue`, and `pubsub`, because the
+> platform only gates *authenticated* principals; for anonymous ingress
+> **the script itself is the only access boundary**. If a public route
+> must not expose every secret or every row in the app, the script must
+> enforce that — check a token, scope the collection, gate the
+> operation. "This route is public" does not mean "this code may only
+> touch public data." See blueprint §11.6 (principal model).
+
 ## Sync ↔ async bridge
 
 Rhai is synchronous; service trait methods (KV writes, HTTP calls) are

docs/stdlib-reference.md

@@ -37,16 +37,33 @@ These come with the Rhai engine itself. See the
 `index_of`, `split`, `trim`, `to_lower`, `to_upper`, `replace`, `chars`,
 `pad`, `sub_string`, `crop`, `+` (concatenation).
 
-> **Footgun — `replace` mutates in place and returns `()`.** Rhai's
-> `String.replace(from, to)` edits the receiver and returns unit, *not*
-> a new string. `let t = auth.replace("Bearer ", "")` sets `t` to `()`,
-> so a downstream `users::verify(t)` fails with
-> `Function not found: users::verify (())`. To strip a known prefix,
-> slice instead:
+> **Footgun — several string methods mutate in place and return `()`.**
+> A whole family of Rhai string methods edit the receiver *in place* and
+> return unit, **not** a new string. `let t = auth.replace("Bearer ", "")`
+> (or `let t = text.trim()`) sets `t` to `()`, so a downstream
+> `text.split(",")` or `users::verify(t)` fails with
+> `Function not found: split (())` / `… (())`.
+>
+> | Method | Returns | Use it as |
+> |---|---|---|
+> | `replace`, `trim`, `make_upper`, `make_lower`, `crop`, `truncate`, `pad` | `()` — **mutates in place** | a statement: `text.trim();` then read `text` |
+> | `to_upper`, `to_lower`, `sub_string`, `split`, `chars` | a **new value** (string / array / range) | an expression: `let u = name.to_upper();` |
+>
+> So `to_upper`/`to_lower` are the *copying* variants (safe in `let x = …`),
+> while `make_upper`/`make_lower` are the in-place ones. To trim and keep
+> the result, mutate then read the same binding:
+> ```rhai
+> let token = auth;
+> token.trim();                       // mutate in place
+> if token.starts_with("Bearer ") {   // now use `token`
+>     token.replace("Bearer ", "");   // again: statement, not `let x = …`
+> }
+> ```
+> Or, to strip a known prefix without mutation, slice:
 > ```rhai
 > let token = if auth.starts_with("Bearer ") { auth.sub_string(7) } else { auth };
 > ```
-> Or call `replace` purely for its side effect: `let t = auth; t.replace("Bearer ", "");`.
+> (Verified against the pinned Rhai `=1.24` build.)
 
 **Array:** `push`, `pop`, `shift`, `insert`, `remove`, `len`, `clear`,
 `truncate`, `extend`, `filter`, `map`, `reduce`, `reduce_rev`, `find`,