test: give three no-teeth assertions their teeth

- roles: member invoke asserts the script's actual stdout, not just exit 0;
- api: app-slug script filter asserts the returned script's name;
- workflow_orchestrator: unknown-workflow asserts WorkflowError::NotFound,
  not just is_err().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/workflow_orchestrator.rs

@@ -27,6 +27,7 @@ use picloud_manager_core::workflow_repo::{
 };
 use picloud_manager_core::workflow_service::WorkflowServiceImpl;
 use picloud_orchestrator_core::{ExecutionGate, ExecutorClient, ScriptIdentity};
+use picloud_shared::workflow::WorkflowError;
 use picloud_shared::workflow::{
     OnError, RunStatus, StepStatus, WorkflowBackoff, WorkflowDefinition, WorkflowRetry,
     WorkflowStepDef,
@@ -943,6 +944,12 @@ async fn workflow_service_start_seeds_a_run() {
         .unwrap();
     assert_eq!(runs.len(), 1);
 
-    // an unknown workflow name is a not-found error.
-    assert!(svc.start(&cx, "ghost", Value::Null).await.is_err());
+    // an unknown workflow name is a NOT-FOUND error specifically — a bare is_err()
+    // would also pass on a DB error, a missing-app error, or a start() that rejects
+    // everything, masking a 500 as a 404.
+    let err = svc.start(&cx, "ghost", Value::Null).await.unwrap_err();
+    assert!(
+        matches!(err, WorkflowError::NotFound(_)),
+        "an unknown workflow must be NotFound, got {err:?}"
+    );
 }