refactor(sdk): consolidate the SDK error/bridge helpers

`http.rs` hand-rolled its own `block_on` + `map_http_err`, and `secrets.rs` /
`email.rs` / `users.rs` each carried a byte-identical `runtime_err` — five
`#[allow(clippy::unnecessary_box_returns)]` across four files for one pattern.

Move `runtime_err` to `bridge.rs` beside `block_on` (single home, single allow)
and have the three bridges import it. `http.rs` now calls the shared
`bridge::block_on("http", …)` (same "http:"-prefixed error, so messages are
unchanged) and its `err` validation helper delegates to `bridge::runtime_err`.
Deletes 4 duplicate fns and 3 of the 5 allows; no behavior change (pinned by
the executor-core SDK contract tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/users.rs

@@ -50,7 +50,7 @@
 
 use std::sync::Arc;
 
-use super::bridge::block_on;
+use super::bridge::{block_on, runtime_err};
 use picloud_shared::{
     AppUser, AppUserId, CreateUserInput, EmailTemplateOpts, GeneratedAccept, GeneratedSession,
     InviteOpts, SdkCallCx, Services, UpdateUserInput, UsersListOpts, UsersListPage, UsersService,
@@ -615,8 +615,3 @@ fn optional_string(opts: &Map, key: &str) -> Option<String> {
         Some(d) => Some(d.to_string()),
     }
 }
-
-#[allow(clippy::unnecessary_box_returns)]
-fn runtime_err(msg: &str) -> Box<EvalAltResult> {
-    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
-}