feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

Finish the §11.6 KV slice: declarative authoring, read-only inspection, the
runtime journey, and docs — plus a forced SDK-name fix.

- SDK name: `shared` is a Rhai RESERVED keyword, so `kv::shared(...)` is a parse
  error. Renamed the handle constructor to `kv::shared_collection(...)`
  (keeps the user's "shared" intent; unambiguous). Updated everywhere.
- CLI manifest: `collections = [...]` on `[group]` only (ManifestApp has no such
  field + deny_unknown_fields → an app manifest carrying it is a hard error);
  Manifest::collections() accessor; build_bundle emits it.
- plan/apply: a `collection` row group in `pic plan`; created/deleted counts in
  the apply summary; collections threaded through PlanDto/NodePlanDto/
  ApplyReportDto.
- read-only `pic collections ls --group` → GET /admin/groups/{id}/collections
  (viewer+), backed by ApplyService::collection_report + CollectionInfo.
- journey: a group declares `catalog`; app A writes, app B (same subtree) reads
  it back; a sibling-subtree app gets CollectionNotShared; `collections ls` +
  re-apply NoOp. Full suite 114/114.
- docs: groups-and-project-tool §11.6 (KV-only MVP shipped + deferrals),
  sdk-shape.md (the shared-collection handle + trust model), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/kv.rs

@@ -42,7 +42,7 @@ pub struct KvHandle {
     cx: Arc<SdkCallCx>,
 }
 
-/// §11.6 shared-collection handle, returned by `kv::shared(name)`. A distinct
+/// §11.6 shared-collection handle, returned by `kv::shared_collection(name)`. A distinct
 /// Rhai type from `KvHandle` so the method set can diverge (e.g. shared
 /// collections never grow triggers) and a script's choice of private-vs-shared
 /// scope is explicit. Routes through the `GroupKvService`, which resolves the
@@ -58,7 +58,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
     let kv_service = services.kv.clone();
     let group_kv_service = services.group_kv.clone();
 
-    // `kv::collection(name)` / `kv::shared(name)` — both constructors live in
+    // `kv::collection(name)` / `kv::shared_collection(name)` — both constructors live in
     // the `kv` static module so the script-visible calls are `kv::collection`
     // and `kv::shared`.
     let mut module = Module::new();
@@ -83,10 +83,10 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
         let group_kv_service = group_kv_service.clone();
         let cx = cx.clone();
         module.set_native_fn(
-            "shared",
+            "shared_collection",
             move |name: &str| -> Result<GroupKvHandle, Box<EvalAltResult>> {
                 if name.is_empty() {
-                    return Err("kv::shared name must not be empty".into());
+                    return Err("kv::shared_collection name must not be empty".into());
                 }
                 Ok(GroupKvHandle {
                     collection: name.to_string(),