fix(executor-core): F-Q-002 promote sdk::bridge::block_on, migrate 9 SDK modules

Replace ten near-identical `block_on` helpers (one per SDK module)
with a single shared `sdk::bridge::block_on(service: &str, fut)`.
The helper takes a service-prefix string and a future whose error
implements Display, so each module's `KvError`/`DocsError`/etc.
still self-formats.

Migrated:
- kv, docs, pubsub, users, dead_letters, secrets, files, email
- queue.rs has two helpers; the inline-shaped enqueue path and the
  block_on_u64 (u64→i64) wrapper are left in place — the latter
  could use the shared helper but the local form is one less call
  site per finding overlap. Will revisit on a later pass if needed.
- http.rs is intentionally NOT migrated: it has per-variant error
  mapping via `map_http_err` that the generic helper can't express.

Net: -218 / +97 lines across the 9 migrated files. Single source of
truth for the runtime-handle lookup and error wrapping.

AUDIT.md anchor: F-Q-002.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/pubsub.rs

@@ -19,11 +19,13 @@ use std::sync::Arc;
 
 use base64::engine::general_purpose::STANDARD;
 use base64::Engine as _;
-use picloud_shared::{PubsubError, SdkCallCx, Services};
+use picloud_shared::{SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 
+use super::bridge::block_on;
+
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
     let svc = services.pubsub.clone();
     let mut module = Module::new();
@@ -36,7 +38,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                 let json = message_to_json(&message);
                 let svc = svc.clone();
                 let cx = cx.clone();
-                block_on(async move { svc.publish_durable(&cx, topic, json).await })
+                block_on("pubsub", async move { svc.publish_durable(&cx, topic, json).await })
             },
         );
     }
@@ -157,20 +159,3 @@ fn message_to_json(value: &Dynamic) -> Json {
     Json::String(value.to_string())
 }
 
-/// Run an async future inside the synchronous Rhai context. Mirrors
-/// `kv::block_on`.
-fn block_on<F>(fut: F) -> Result<(), Box<EvalAltResult>>
-where
-    F: std::future::Future<Output = Result<(), PubsubError>> + Send,
-{
-    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
-        EvalAltResult::ErrorRuntime(
-            format!("pubsub: no tokio runtime available: {e}").into(),
-            rhai::Position::NONE,
-        )
-        .into()
-    })?;
-    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
-        EvalAltResult::ErrorRuntime(format!("pubsub: {err}").into(), rhai::Position::NONE).into()
-    })
-}