refactor(sdk): consolidate the SDK error/bridge helpers

`http.rs` hand-rolled its own `block_on` + `map_http_err`, and `secrets.rs` /
`email.rs` / `users.rs` each carried a byte-identical `runtime_err` — five
`#[allow(clippy::unnecessary_box_returns)]` across four files for one pattern.

Move `runtime_err` to `bridge.rs` beside `block_on` (single home, single allow)
and have the three bridges import it. `http.rs` now calls the shared
`bridge::block_on("http", …)` (same "http:"-prefixed error, so messages are
unchanged) and its `err` validation helper delegates to `bridge::runtime_err`.
Deletes 4 duplicate fns and 3 of the 5 allows; no behavior change (pinned by
the executor-core SDK contract tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/secrets.rs

@@ -21,7 +21,7 @@ use std::sync::Arc;
 use picloud_shared::{SdkCallCx, SecretsListPage, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 
-use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
+use super::bridge::{block_on, dynamic_to_json, json_to_dynamic, runtime_err};
 
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
     let svc = services.secrets.clone();
@@ -124,10 +124,3 @@ fn list_page_to_map(page: SecretsListPage) -> Map {
     );
     m
 }
-
-// Returns the boxed error directly because every caller needs a
-// `Box<EvalAltResult>` (Rhai's error type), matching the other bridges.
-#[allow(clippy::unnecessary_box_returns)]
-fn runtime_err(msg: &str) -> Box<EvalAltResult> {
-    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
-}