feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

Finish the §11.6 KV slice: declarative authoring, read-only inspection, the
runtime journey, and docs — plus a forced SDK-name fix.

- SDK name: `shared` is a Rhai RESERVED keyword, so `kv::shared(...)` is a parse
  error. Renamed the handle constructor to `kv::shared_collection(...)`
  (keeps the user's "shared" intent; unambiguous). Updated everywhere.
- CLI manifest: `collections = [...]` on `[group]` only (ManifestApp has no such
  field + deny_unknown_fields → an app manifest carrying it is a hard error);
  Manifest::collections() accessor; build_bundle emits it.
- plan/apply: a `collection` row group in `pic plan`; created/deleted counts in
  the apply summary; collections threaded through PlanDto/NodePlanDto/
  ApplyReportDto.
- read-only `pic collections ls --group` → GET /admin/groups/{id}/collections
  (viewer+), backed by ApplyService::collection_report + CollectionInfo.
- journey: a group declares `catalog`; app A writes, app B (same subtree) reads
  it back; a sibling-subtree app gets CollectionNotShared; `collections ls` +
  re-apply NoOp. Full suite 114/114.
- docs: groups-and-project-tool §11.6 (KV-only MVP shipped + deferrals),
  sdk-shape.md (the shared-collection handle + trust model), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -437,6 +437,12 @@ pub struct ExtensionPointInfo {
     pub provider: Option<String>,
 }
 
+/// One row of the read-only §11.6 shared-collection report.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CollectionInfo {
+    pub name: String,
+}
+
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
@@ -1772,6 +1778,24 @@ impl ApplyService {
         }
     }
 
+    /// Read-only §11.6 shared-collection report for a node: the shared KV
+    /// collection names declared directly at it. Group-only in practice (the
+    /// CLI rejects app-declared collections); an app node returns its own
+    /// (degenerate) declarations, if any. Backs `pic collections ls`.
+    pub async fn collection_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<CollectionInfo>, ApplyError> {
+        let names =
+            crate::group_collection_repo::list_for_owner(&self.pool, owner.as_script_owner())
+                .await
+                .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        Ok(names
+            .into_iter()
+            .map(|name| CollectionInfo { name })
+            .collect())
+    }
+
     /// §5.5 no-provider plan check (app nodes only). Every extension point
     /// visible to the app — declared in this bundle or inherited from an
     /// ancestor — must have a provider: a module of that name the app provides