fix(cms-poc): remediate findings surfaced by the CMS proof-of-concept

Additive fixes surfaced by building a full CMS on PiCloud
(examples/cms-poc/). One migration (0077_apps_cors.sql); no destructive
changes.

Security:
- Close the 502 info-leak on user routes: an uncaught script error (incl.
  a throw) leaked the app UUID + script fn names + source line/col. The
  user-route (inbox) path now shares scrub_runtime_detail with the
  execute-by-id path — raw detail is logged under a correlation id and the
  client sees only "script execution error (ref: <uuid>)".

Added:
- docs::find $contains operator (array membership via JSONB @>), per-app
  and group-shared — the inverse of $in.
- App-user role management from API/CLI: pic users add-role / rm-role,
  backed by the apps/{id}/users/{user_id}/roles endpoints (AppUsersAdmin).
- Per-app CORS: pic apps cors set, apps.cors_allowed_origins; the
  orchestrator echoes an allowed Origin and answers OPTIONS preflight.
- Non-JSON request bodies: form-urlencoded -> object, text/* -> string,
  other -> base64; ctx.request.content_type added. Malformed JSON still 400s.
- Binary responses via #{ body_base64 } with a script-set Content-Type.
- workflow::run_status(run_id) SDK (F-038): the starting script can poll a
  run — #{ status, output, error, steps } or () when no such run belongs to
  the app (app_id is the isolation boundary); same AppInvoke gate as start.

Fixed:
- pic apply "app not found" is now actionable (points at pic apps create).
- Interceptor- (F-021) and workflow-step-bound (F-037) scripts no longer
  warn "no route or trigger" at plan time — both count as reachability.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/executor-core/tests/engine.rs

@@ -93,6 +93,26 @@ fn returns_structured_response_when_status_code_present() {
     assert_eq!(resp.body, json!({ "ok": true, "msg": "created" }));
 }
 
+#[test]
+fn body_base64_envelope_sets_binary_response() {
+    // F-026: a `body_base64` field carries raw bytes; `body` is ignored.
+    let src = r#"
+        #{ statusCode: 200,
+           headers: #{ "content-type": "image/png" },
+           body: #{ ignored: true },
+           body_base64: "aGVsbG8=" }
+    "#;
+    let resp = engine().execute(src, req(json!(null))).unwrap();
+    assert_eq!(resp.status_code, 200);
+    assert_eq!(resp.body_base64.as_deref(), Some("aGVsbG8="));
+    // `body` is nulled out when body_base64 is present.
+    assert_eq!(resp.body, json!(null));
+    assert_eq!(
+        resp.headers.get("content-type").map(String::as_str),
+        Some("image/png")
+    );
+}
+
 #[test]
 fn ctx_exposes_request_data() {
     let src = r"