fix(cms-poc): remediate findings surfaced by the CMS proof-of-concept

Additive fixes surfaced by building a full CMS on PiCloud
(examples/cms-poc/). One migration (0077_apps_cors.sql); no destructive
changes.

Security:
- Close the 502 info-leak on user routes: an uncaught script error (incl.
  a throw) leaked the app UUID + script fn names + source line/col. The
  user-route (inbox) path now shares scrub_runtime_detail with the
  execute-by-id path — raw detail is logged under a correlation id and the
  client sees only "script execution error (ref: <uuid>)".

Added:
- docs::find $contains operator (array membership via JSONB @>), per-app
  and group-shared — the inverse of $in.
- App-user role management from API/CLI: pic users add-role / rm-role,
  backed by the apps/{id}/users/{user_id}/roles endpoints (AppUsersAdmin).
- Per-app CORS: pic apps cors set, apps.cors_allowed_origins; the
  orchestrator echoes an allowed Origin and answers OPTIONS preflight.
- Non-JSON request bodies: form-urlencoded -> object, text/* -> string,
  other -> base64; ctx.request.content_type added. Malformed JSON still 400s.
- Binary responses via #{ body_base64 } with a script-set Content-Type.
- workflow::run_status(run_id) SDK (F-038): the starting script can poll a
  run — #{ status, output, error, steps } or () when no such run belongs to
  the app (app_id is the isolation boundary); same AppInvoke gate as start.

Fixed:
- pic apply "app not found" is now actionable (points at pic apps create).
- Interceptor- (F-021) and workflow-step-bound (F-037) scripts no longer
  warn "no route or trigger" at plan time — both count as reachability.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/shared/src/exec_summary.rs

@@ -13,4 +13,9 @@ pub struct ExecResponseSummary {
     pub status_code: u16,
     pub headers: BTreeMap<String, String>,
     pub body: serde_json::Value,
+    /// F-026 binary response: base64 raw bytes to return instead of JSON-encoding
+    /// `body`. `None` ⇒ the normal JSON path. `#[serde(default)]` keeps the wire
+    /// format backward-compatible.
+    #[serde(default)]
+    pub body_base64: Option<String>,
 }

crates/shared/src/lib.rs

@@ -127,5 +127,6 @@ pub use vars::{NoopVarsService, VarsError, VarsService};
 pub use version::{API_VERSION, PRODUCT_VERSION, SDK_VERSION, WIRE_VERSION};
 pub use workflow::{
     default_base_ms, NoopWorkflowService, OnError, RunStatus, StepStatus, WorkflowBackoff,
-    WorkflowDefinition, WorkflowError, WorkflowRetry, WorkflowService, WorkflowStepDef,
+    WorkflowDefinition, WorkflowError, WorkflowRetry, WorkflowRunView, WorkflowService,
+    WorkflowStepDef, WorkflowStepView,
 };

crates/shared/src/workflow.rs

@@ -29,6 +29,42 @@ pub trait WorkflowService: Send + Sync {
         name: &str,
         input: serde_json::Value,
     ) -> Result<WorkflowRunId, WorkflowError>;
+
+    /// Read the status of a run started in `cx.app_id` (F-038): a script that
+    /// called `workflow::start` can poll its progress without the admin API.
+    /// Returns `None` when no such run belongs to this app (the app-scope walk
+    /// is the isolation boundary). Default errors so a misconfigured service
+    /// can't silently report "no run".
+    async fn run_status(
+        &self,
+        cx: &SdkCallCx,
+        run_id: WorkflowRunId,
+    ) -> Result<Option<WorkflowRunView>, WorkflowError> {
+        let _ = (cx, run_id);
+        Err(WorkflowError::Backend(
+            "workflow service is not configured".into(),
+        ))
+    }
+}
+
+/// A read-only view of a workflow run for `workflow::run_status` (F-038).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkflowRunView {
+    pub run_id: WorkflowRunId,
+    pub status: RunStatus,
+    /// The run's final output (present once succeeded), else `None`.
+    pub output: Option<serde_json::Value>,
+    /// The failure reason (present once failed), else `None`.
+    pub error: Option<String>,
+    /// Per-step status, in step-name order.
+    pub steps: Vec<WorkflowStepView>,
+}
+
+/// One step's status within a [`WorkflowRunView`].
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkflowStepView {
+    pub name: String,
+    pub status: StepStatus,
 }
 
 #[derive(Debug, Error)]