test(sdk): give the isolation and retry-negative tests teeth

Three tests that would pass against a broken implementation:

- `kv`/`docs` cross-app isolation asserted only that app B sees nothing — an
  execution_id-keyed (or script_id-keyed) bridge would pass that AND every
  single-execution round-trip, with app-scoped persistence entirely gone. Added
  the positive control: app A re-reads its own value in a LATER execution (a fresh
  execution_id/script_id via `baseline_request`), which only holds if storage is
  keyed by app_id.

- `retry_policy_rejects_bogus_backoff` asserted a bare `is_err()`, which passes if
  `retry::policy` is unregistered (ErrorFunctionNotFound), on a script typo, or if
  every policy is rejected. Now it pins the message (`backoff`) and adds a
  valid-backoff control that must succeed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/tests/sdk_retry.rs

@@ -140,12 +140,40 @@ async fn retry_policy_clamps_visible_at_script_layer() {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_policy_rejects_bogus_backoff() {
     let engine = build_engine();
+
+    // Pin the REASON. A bare `is_err()` would pass if `retry::policy` were not
+    // registered at all (ErrorFunctionNotFound), or on a typo in the script
+    // source, or if EVERY policy were rejected — none of which is "an invalid
+    // backoff is rejected". The message must name `backoff`.
     let src = r#"retry::policy(#{ backoff: "bogus" });"#.to_string();
     let req = baseline_request(AppId::new());
-    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
+    let err = tokio::task::spawn_blocking({
+        let engine = engine.clone();
+        move || engine.execute(&src, req)
+    })
+    .await
+    .unwrap()
+    .unwrap_err()
+    .to_string();
+    assert!(
+        err.to_lowercase().contains("backoff"),
+        "the rejection must be about the backoff value specifically, got: {err}"
+    );
+
+    // Control: the SAME call with a VALID backoff succeeds — proving `retry::policy`
+    // is registered and does not reject everything, so the failure above is
+    // specific to the bad value.
+    let ok_src = r#"
+        let p = retry::policy(#{ backoff: "constant", max_attempts: 2, base_ms: 1 });
+        retry::run(p, || 7)
+    "#
+    .to_string();
+    let req = baseline_request(AppId::new());
+    let resp = tokio::task::spawn_blocking(move || engine.execute(&ok_src, req))
         .await
-        .unwrap();
-    assert!(res.is_err());
+        .unwrap()
+        .expect("a valid backoff must be accepted");
+    assert_eq!(resp.body, serde_json::json!(7));
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]