test: give three no-teeth assertions their teeth

- roles: member invoke asserts the script's actual stdout, not just exit 0;
- api: app-slug script filter asserts the returned script's name;
- workflow_orchestrator: unknown-workflow asserts WorkflowError::NotFound,
  not just is_err().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/roles.rs

@@ -117,10 +117,15 @@ fn member_can_invoke_any_script_with_id() {
     let member_env = common::custom_env(&fx.url, &m.token);
     common::seed_credentials(&member_env, &m.username);
 
+    // Assert the script actually RAN, not just that the command exited 0 — a
+    // no-op that printed nothing, or a 200 with an error envelope the CLI didn't
+    // treat as failure, would pass a bare `.success()`. `hello.rhai` emits
+    // "hello". (The sibling roles test one screen up does exactly this.)
     common::pic_as(&member_env)
         .args(["scripts", "invoke", &id])
         .assert()
-        .success();
+        .success()
+        .stdout(predicate::str::contains("hello"));
 }
 
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]