feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

Finish the §11.6 KV slice: declarative authoring, read-only inspection, the
runtime journey, and docs — plus a forced SDK-name fix.

- SDK name: `shared` is a Rhai RESERVED keyword, so `kv::shared(...)` is a parse
  error. Renamed the handle constructor to `kv::shared_collection(...)`
  (keeps the user's "shared" intent; unambiguous). Updated everywhere.
- CLI manifest: `collections = [...]` on `[group]` only (ManifestApp has no such
  field + deny_unknown_fields → an app manifest carrying it is a hard error);
  Manifest::collections() accessor; build_bundle emits it.
- plan/apply: a `collection` row group in `pic plan`; created/deleted counts in
  the apply summary; collections threaded through PlanDto/NodePlanDto/
  ApplyReportDto.
- read-only `pic collections ls --group` → GET /admin/groups/{id}/collections
  (viewer+), backed by ApplyService::collection_report + CollectionInfo.
- journey: a group declares `catalog`; app A writes, app B (same subtree) reads
  it back; a sibling-subtree app gets CollectionNotShared; `collections ls` +
  re-apply NoOp. Full suite 114/114.
- docs: groups-and-project-tool §11.6 (KV-only MVP shipped + deferrals),
  sdk-shape.md (the shared-collection handle + trust model), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/migrations/0052_group_collections.sql

@@ -2,7 +2,7 @@
 --
 -- A row marks a collection NAME at a node as group-SHARED: every app in the
 -- owning group's subtree may read it (and, with an authenticated editor+,
--- write it) via the explicit `kv::shared("name")` SDK handle. Resolution is
+-- write it) via the explicit `kv::shared_collection("name")` SDK handle. Resolution is
 -- nearest-ancestor-group-wins, walking the reading app's chain — that ancestry
 -- walk is the isolation boundary (a foreign app's chain never contains the
 -- owning group, so the name simply does not resolve). See docs §11.6.

crates/manager-core/src/apply_api.rs

@@ -17,8 +17,8 @@ use serde_json::json;
 
 use crate::app_repo::AppRepository;
 use crate::apply_service::{
-    ApplyError, ApplyOwner, ApplyReport, ApplyService, Bundle, BundleTrigger, ExtensionPointInfo,
-    NodeKind, PlanResult, TreeBundle, TreePlanResult,
+    ApplyError, ApplyOwner, ApplyReport, ApplyService, Bundle, BundleTrigger, CollectionInfo,
+    ExtensionPointInfo, NodeKind, PlanResult, TreeBundle, TreePlanResult,
 };
 use crate::authz::{require, AuthzDenied, Capability};
 use crate::group_repo::GroupRepository;
@@ -40,9 +40,29 @@ pub fn apply_router(service: ApplyService) -> Router {
             "/groups/{id}/extension-points",
             get(group_extension_points_handler),
         )
+        .route("/groups/{id}/collections", get(group_collections_handler))
         .with_state(service)
 }
 
+/// Read-only §11.6 shared-collection report for a group: its own declared
+/// shared KV collection names. Viewer-tier read.
+async fn group_collections_handler(
+    State(svc): State<ApplyService>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+) -> Result<Json<Vec<CollectionInfo>>, ApplyError> {
+    let group_id = resolve_group_id(svc.groups.as_ref(), &id_or_slug).await?;
+    require(
+        svc.authz.as_ref(),
+        &principal,
+        Capability::GroupScriptsRead(group_id),
+    )
+    .await
+    .map_err(map_authz)?;
+    let report = svc.collection_report(ApplyOwner::Group(group_id)).await?;
+    Ok(Json(report))
+}
+
 /// Read-only §5.5 extension-point report for an app: every EP visible on its
 /// chain, each with `declared_here` + resolved `provider`. Viewer-tier read.
 async fn app_extension_points_handler(

crates/manager-core/src/apply_service.rs

@@ -437,6 +437,12 @@ pub struct ExtensionPointInfo {
     pub provider: Option<String>,
 }
 
+/// One row of the read-only §11.6 shared-collection report.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CollectionInfo {
+    pub name: String,
+}
+
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
@@ -1772,6 +1778,24 @@ impl ApplyService {
         }
     }
 
+    /// Read-only §11.6 shared-collection report for a node: the shared KV
+    /// collection names declared directly at it. Group-only in practice (the
+    /// CLI rejects app-declared collections); an app node returns its own
+    /// (degenerate) declarations, if any. Backs `pic collections ls`.
+    pub async fn collection_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<CollectionInfo>, ApplyError> {
+        let names =
+            crate::group_collection_repo::list_for_owner(&self.pool, owner.as_script_owner())
+                .await
+                .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        Ok(names
+            .into_iter()
+            .map(|name| CollectionInfo { name })
+            .collect())
+    }
+
     /// §5.5 no-provider plan check (app nodes only). Every extension point
     /// visible to the app — declared in this bundle or inherited from an
     /// ancestor — must have a provider: a module of that name the app provides

crates/manager-core/src/group_kv_service.rs

@@ -1,6 +1,6 @@
 //! `GroupKvServiceImpl` — wires `GroupKvRepo` + the group-collection registry
 //! underneath the `picloud_shared::GroupKvService` trait that scripts reach via
-//! the `kv::shared("name")` Rhai handle (§11.6).
+//! the `kv::shared_collection("name")` Rhai handle (§11.6).
 //!
 //! Layers added over the raw repo:
 //!