refactor(sdk): consolidate the SDK error/bridge helpers

`http.rs` hand-rolled its own `block_on` + `map_http_err`, and `secrets.rs` /
`email.rs` / `users.rs` each carried a byte-identical `runtime_err` — five
`#[allow(clippy::unnecessary_box_returns)]` across four files for one pattern.

Move `runtime_err` to `bridge.rs` beside `block_on` (single home, single allow)
and have the three bridges import it. `http.rs` now calls the shared
`bridge::block_on("http", …)` (same "http:"-prefixed error, so messages are
unchanged) and its `err` validation helper delegates to `bridge::runtime_err`.
Deletes 4 duplicate fns and 3 of the 5 allows; no behavior change (pinned by
the executor-core SDK contract tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/bridge.rs

@@ -43,6 +43,15 @@ where
     })
 }
 
+/// Build a Rhai runtime error from a message. Returns the boxed error
+/// directly because every caller needs a `Box<EvalAltResult>` (Rhai's error
+/// type) — the shared home for the pattern the SDK bridges (secrets, email,
+/// users, …) previously each copied.
+#[allow(clippy::unnecessary_box_returns)]
+pub(crate) fn runtime_err(msg: &str) -> Box<EvalAltResult> {
+    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
+}
+
 /// Convert a `serde_json::Value` into a Rhai `Dynamic` suitable for
 /// pushing into a script's scope. Numbers prefer the narrowest type
 /// (`i64` over `f64`); anything that can't round-trip falls back to a