feat(v1.1.3-modules): top-level script AST cache in LocalExecutorClient

- New `ScriptIdentity { script_id, updated_at }` DTO.
- `ExecutorClient` trait gains an `execute_with_identity` method;
  default impl forwards to `execute` so `RemoteExecutorClient` (and
  cluster-mode transports later) keep working without bespoke caching.
- `LocalExecutorClient` overrides `execute_with_identity` to consult
  an `LruCache<ScriptId, CachedScript>`. Cache hit only when the
  cached entry's `updated_at` matches the caller's identity; mismatch
  triggers a fresh `Engine::compile`. `Engine::execute_ast(&Arc<AST>, req)`
  is called inside `spawn_blocking` exactly as `execute` does today.
- Cache size from `PICLOUD_SCRIPT_CACHE_SIZE` (default 256).
- Orchestrator's HTTP data-plane path and the dispatcher both switch
  to `execute_with_identity`. `ResolvedTrigger` carries
  `script_updated_at` for the dispatcher's identity construction.

Workspace builds; full test suite (~440 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/dispatcher.rs

@@ -186,9 +186,13 @@ impl Dispatcher {
         // wait synchronously here — sync HTTP and dispatcher share the
         // semaphore so this is intentional.
         let source = resolved.script_source.clone();
+        let identity = picloud_orchestrator_core::ScriptIdentity {
+            script_id: resolved.script_id,
+            updated_at: resolved.script_updated_at,
+        };
         let outcome = self
             .executor
-            .execute(&source, exec_req, ASYNC_EXEC_TIMEOUT)
+            .execute_with_identity(identity, &source, exec_req, ASYNC_EXEC_TIMEOUT)
             .await;
         drop(permit);
 
@@ -230,6 +234,7 @@ impl Dispatcher {
             script_id: script.id,
             script_source: script.source,
             script_name: script.name,
+            script_updated_at: script.updated_at,
             sandbox_overrides: script.sandbox,
             registered_by_principal: trigger.registered_by_principal,
             retry_max_attempts: trigger.retry_max_attempts,
@@ -335,6 +340,7 @@ impl Dispatcher {
             script_id,
             script_source: script.source,
             script_name: payload.script_name,
+            script_updated_at: script.updated_at,
             sandbox_overrides: script.sandbox,
             // HTTP outbox rows don't carry a registered_by_principal
             // — use a sentinel zero UUID since this field isn't used
@@ -516,6 +522,11 @@ pub struct ResolvedTrigger {
     pub script_id: ScriptId,
     pub script_source: String,
     pub script_name: String,
+    /// v1.1.3: freshness comparator for the orchestrator's top-level
+    /// script cache. The dispatcher hands `(script_id, updated_at)`
+    /// in alongside the source so cached ASTs can be reused across
+    /// triggered invocations.
+    pub script_updated_at: chrono::DateTime<chrono::Utc>,
     pub sandbox_overrides: ScriptSandbox,
     pub registered_by_principal: picloud_shared::AdminUserId,
     pub retry_max_attempts: u32,