feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

Finish the §11.6 KV slice: declarative authoring, read-only inspection, the
runtime journey, and docs — plus a forced SDK-name fix.

- SDK name: `shared` is a Rhai RESERVED keyword, so `kv::shared(...)` is a parse
  error. Renamed the handle constructor to `kv::shared_collection(...)`
  (keeps the user's "shared" intent; unambiguous). Updated everywhere.
- CLI manifest: `collections = [...]` on `[group]` only (ManifestApp has no such
  field + deny_unknown_fields → an app manifest carrying it is a hard error);
  Manifest::collections() accessor; build_bundle emits it.
- plan/apply: a `collection` row group in `pic plan`; created/deleted counts in
  the apply summary; collections threaded through PlanDto/NodePlanDto/
  ApplyReportDto.
- read-only `pic collections ls --group` → GET /admin/groups/{id}/collections
  (viewer+), backed by ApplyService::collection_report + CollectionInfo.
- journey: a group declares `catalog`; app A writes, app B (same subtree) reads
  it back; a sibling-subtree app gets CollectionNotShared; `collections ls` +
  re-apply NoOp. Full suite 114/114.
- docs: groups-and-project-tool §11.6 (KV-only MVP shipped + deferrals),
  sdk-shape.md (the shared-collection handle + trust model), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/apply.rs

@@ -91,6 +91,13 @@ pub async fn run(
                 "+{} -{}",
                 report.extension_points_created, report.extension_points_deleted
             ),
+        )
+        .field(
+            "collections",
+            format!(
+                "+{} -{}",
+                report.collections_created, report.collections_deleted
+            ),
         );
     for w in &report.warnings {
         block.field("warning", w.clone());
@@ -165,6 +172,13 @@ pub async fn run_tree(
                 "+{} -{}",
                 report.extension_points_created, report.extension_points_deleted
             ),
+        )
+        .field(
+            "collections",
+            format!(
+                "+{} -{}",
+                report.collections_created, report.collections_deleted
+            ),
         );
     for w in &report.warnings {
         block.field("warning", w.clone());

crates/picloud-cli/src/cmds/collections.rs

@@ -0,0 +1,23 @@
+//! `pic collections ls --group <g>` — read-only view of a group's §11.6 shared
+//! KV collections. Group-only (shared collections are owned by groups);
+//! authoring is declarative via the `[group]` manifest `collections = [...]`.
+//! Scripts read/write them with `kv::shared_collection("name")`.
+
+use anyhow::Result;
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{OutputMode, Table};
+
+pub async fn ls(group: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let items = client.collections_list(group).await?;
+
+    let mut table = Table::new(["name"]);
+    for c in &items {
+        table.row([c.name.clone()]);
+    }
+    table.print(mode);
+    Ok(())
+}

crates/picloud-cli/src/cmds/mod.rs

@@ -3,6 +3,7 @@ pub mod api_keys;
 pub mod apply;
 pub mod apps;
 pub mod apps_domains;
+pub mod collections;
 pub mod config;
 pub mod dead_letters;
 pub mod extension_points;

crates/picloud-cli/src/cmds/plan.rs

@@ -64,13 +64,14 @@ fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
     let mut table = Table::new(["node", "kind", "op", "resource", "detail"]);
     for n in &plan.nodes {
         let node = format!("{}:{}", n.kind, n.slug);
-        let groups: [(&str, &Vec<ChangeDto>); 6] = [
+        let groups: [(&str, &Vec<ChangeDto>); 7] = [
             ("script", &n.scripts),
             ("route", &n.routes),
             ("trigger", &n.triggers),
             ("secret", &n.secrets),
             ("var", &n.vars),
             ("extension_point", &n.extension_points),
+            ("collection", &n.collections),
         ];
         for (rk, changes) in groups {
             for c in changes {
@@ -162,6 +163,7 @@ pub fn build_bundle(manifest: &Manifest, base_dir: &Path) -> Result<Value> {
         "secrets": manifest.secrets.names,
         "vars": vars,
         "extension_points": manifest.extension_points(),
+        "collections": manifest.collections(),
     }))
 }
 
@@ -176,13 +178,14 @@ fn tagged(kind: &str, spec: impl Serialize) -> Result<Value> {
 
 fn render(plan: &PlanDto, mode: OutputMode) {
     let mut table = Table::new(["kind", "op", "resource", "detail"]);
-    let groups: [(&str, &Vec<ChangeDto>); 6] = [
+    let groups: [(&str, &Vec<ChangeDto>); 7] = [
         ("script", &plan.scripts),
         ("route", &plan.routes),
         ("trigger", &plan.triggers),
         ("secret", &plan.secrets),
         ("var", &plan.vars),
         ("extension_point", &plan.extension_points),
+        ("collection", &plan.collections),
     ];
     for (kind, changes) in groups {
         for c in changes {