test: give three no-teeth assertions their teeth

- roles: member invoke asserts the script's actual stdout, not just exit 0;
- api: app-slug script filter asserts the returned script's name;
- workflow_orchestrator: unknown-workflow asserts WorkflowError::NotFound,
  not just is_err().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/workflow_orchestrator.rs

@@ -27,6 +27,7 @@ use picloud_manager_core::workflow_repo::{
 };
 use picloud_manager_core::workflow_service::WorkflowServiceImpl;
 use picloud_orchestrator_core::{ExecutionGate, ExecutorClient, ScriptIdentity};
+use picloud_shared::workflow::WorkflowError;
 use picloud_shared::workflow::{
     OnError, RunStatus, StepStatus, WorkflowBackoff, WorkflowDefinition, WorkflowRetry,
     WorkflowStepDef,
@@ -943,6 +944,12 @@ async fn workflow_service_start_seeds_a_run() {
         .unwrap();
     assert_eq!(runs.len(), 1);
 
-    // an unknown workflow name is a not-found error.
+    // an unknown workflow name is a NOT-FOUND error specifically — a bare is_err()
-    assert!(svc.start(&cx, "ghost", Value::Null).await.is_err());
+    // would also pass on a DB error, a missing-app error, or a start() that rejects
+    // everything, masking a 500 as a 404.
+    let err = svc.start(&cx, "ghost", Value::Null).await.unwrap_err();
+    assert!(
+        matches!(err, WorkflowError::NotFound(_)),
+        "an unknown workflow must be NotFound, got {err:?}"
+    );
 }

crates/picloud-cli/tests/roles.rs

@@ -117,10 +117,15 @@ fn member_can_invoke_any_script_with_id() {
     let member_env = common::custom_env(&fx.url, &m.token);
     common::seed_credentials(&member_env, &m.username);
 
+    // Assert the script actually RAN, not just that the command exited 0 — a
+    // no-op that printed nothing, or a 200 with an error envelope the CLI didn't
+    // treat as failure, would pass a bare `.success()`. `hello.rhai` emits
+    // "hello". (The sibling roles test one screen up does exactly this.)
     common::pic_as(&member_env)
         .args(["scripts", "invoke", &id])
         .assert()
-        .success();
+        .success()
+        .stdout(predicate::str::contains("hello"));
 }
 
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]

crates/picloud/tests/api.rs

@@ -1208,6 +1208,10 @@ async fn list_scripts_filtered_by_app(pool: PgPool) {
         .await
         .json();
     assert_eq!(filtered_by_slug.len(), 1);
+    // Check the CONTENT, not just the count: a slug that resolved to the WRONG
+    // app (or was ignored, returning the first script) would also yield one row,
+    // hiding a cross-app leak. The by-id case above pins its content; this must too.
+    assert_eq!(filtered_by_slug[0]["name"], "in-other");
 }
 
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]