feat(v1.1.3-modules): top-level script AST cache in LocalExecutorClient

- New `ScriptIdentity { script_id, updated_at }` DTO.
- `ExecutorClient` trait gains an `execute_with_identity` method;
  default impl forwards to `execute` so `RemoteExecutorClient` (and
  cluster-mode transports later) keep working without bespoke caching.
- `LocalExecutorClient` overrides `execute_with_identity` to consult
  an `LruCache<ScriptId, CachedScript>`. Cache hit only when the
  cached entry's `updated_at` matches the caller's identity; mismatch
  triggers a fresh `Engine::compile`. `Engine::execute_ast(&Arc<AST>, req)`
  is called inside `spawn_blocking` exactly as `execute` does today.
- Cache size from `PICLOUD_SCRIPT_CACHE_SIZE` (default 256).
- Orchestrator's HTTP data-plane path and the dispatcher both switch
  to `execute_with_identity`. `ResolvedTrigger` carries
  `script_updated_at` for the dispatcher's identity construction.

Workspace builds; full test suite (~440 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/orchestrator-core/src/api.rs

@@ -129,7 +129,14 @@ where
 
     let timeout = Duration::from_secs(u64::from(script.timeout_seconds));
     let started = Utc::now();
-    let outcome = state.executor.execute(&script.source, req, timeout).await;
+    let identity = crate::client::ScriptIdentity {
+        script_id: script.id,
+        updated_at: script.updated_at,
+    };
+    let outcome = state
+        .executor
+        .execute_with_identity(identity, &script.source, req, timeout)
+        .await;
     let finished = Utc::now();
 
     // Build and dispatch the audit log regardless of outcome. We await