docs(examples): add the CMS proof-of-concept dogfooding artifact

A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts
deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the
project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron
+pubsub triggers, the transactional-outbox notification chain, a docs
before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a
durable Workflow (validate -> enrich || seo -> publish -> finalize) started
with workflow::start and polled with workflow::run_status, visualized live
with Svelte Flow.

FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue
found (each tagged [PiCloud] vs [CMS]); the platform fixes for the
actionable ones ship in the preceding commit.

Also folds in the read-only `pic` allowlist entries added to
.claude/settings.json during the session (fewer-permission-prompts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/cms-poc/scripts/util.rhai

@@ -0,0 +1,40 @@
+// util — shared helpers (kind=module). import "util" as util;
+
+// Turn a title into a URL slug: lowercase, non-alnum -> hyphen, trim hyphens.
+fn slugify(s) {
+    let out = s.to_lower();
+    out = regex::replace_all("[^a-z0-9]+", out, "-");
+    out = regex::replace_all("(^-+|-+$)", out, "");
+    if out == "" { out = "untitled"; }
+    out
+}
+
+// Flatten a docs envelope { id, data, created_at, updated_at } into a single
+// map (data fields + id/timestamps) for JSON responses.
+fn shape_doc(doc) {
+    let d = doc.data;
+    d.id = doc.id;
+    d.created_at = doc.created_at;
+    d.updated_at = doc.updated_at;
+    d
+}
+
+fn to_int_or(s, dflt) {
+    if s == () { return dflt; }
+    if type_of(s) == "i64" || type_of(s) == "int" { return s; }
+    try { parse_int(s) } catch(e) { dflt }
+}
+
+// Atomic KV counter increment via set_if (CAS), bounded retries.
+fn incr(coll_name, key) {
+    let c = kv::collection(coll_name);
+    let i = 0;
+    while i < 8 {
+        let cur = c.get(key);
+        let n = if cur == () { 0 } else { cur };
+        if c.set_if(key, cur, n + 1) { return n + 1; }
+        i += 1;
+    }
+    // give up gracefully — a stale counter is not worth failing the request
+    c.get(key)
+}