docs(examples): add the CMS proof-of-concept dogfooding artifact

A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts
deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the
project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron
+pubsub triggers, the transactional-outbox notification chain, a docs
before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a
durable Workflow (validate -> enrich || seo -> publish -> finalize) started
with workflow::start and polled with workflow::run_status, visualized live
with Svelte Flow.

FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue
found (each tagged [PiCloud] vs [CMS]); the platform fixes for the
actionable ones ship in the preceding commit.

Also folds in the read-only `pic` allowlist entries added to
.claude/settings.json during the session (fewer-permission-prompts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/cms-poc/scripts/notify/notify_drain.rhai

@@ -0,0 +1,28 @@
+// notify_drain — queue TRIGGER on `post-notifications`. Sends one email per
+// reader in the batch via email::send_html (relayed to Mailpit in dev).
+let msg = ctx.event.queue.message;
+if msg == () { return; }
+
+let from = vars::get("notify-from-email");
+let base = vars::get("site-base-url");
+let title = msg.title;
+let url = base + "/posts/" + msg.slug;
+
+let sent = 0;
+for addr in msg.emails {
+    try {
+        email::send_html(#{
+            to: addr,
+            from: from,
+            subject: "New post: " + title,
+            text: "A new post was published: " + title + "\n\nRead it: " + url,
+            html: "<h2>" + title + "</h2>"
+                + "<p>A new post was just published on the blog.</p>"
+                + "<p><a href=\"" + url + "\">Read it here</a></p>",
+        });
+        sent += 1;
+    } catch(e) {
+        log::warn("notify email failed", #{ to: addr, err: "" + e });
+    }
+}
+log::info("sent post notifications", #{ title: title, sent: sent });