test: give three no-teeth assertions their teeth

- roles: member invoke asserts the script's actual stdout, not just exit 0;
- api: app-slug script filter asserts the returned script's name;
- workflow_orchestrator: unknown-workflow asserts WorkflowError::NotFound,
  not just is_err().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud/tests/api.rs

@@ -1208,6 +1208,10 @@ async fn list_scripts_filtered_by_app(pool: PgPool) {
         .await
         .json();
     assert_eq!(filtered_by_slug.len(), 1);
+    // Check the CONTENT, not just the count: a slug that resolved to the WRONG
+    // app (or was ignored, returning the first script) would also yield one row,
+    // hiding a cross-app leak. The by-id case above pins its content; this must too.
+    assert_eq!(filtered_by_slug[0]["name"], "in-other");
 }
 
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]