feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

Finish the §11.6 KV slice: declarative authoring, read-only inspection, the
runtime journey, and docs — plus a forced SDK-name fix.

- SDK name: `shared` is a Rhai RESERVED keyword, so `kv::shared(...)` is a parse
  error. Renamed the handle constructor to `kv::shared_collection(...)`
  (keeps the user's "shared" intent; unambiguous). Updated everywhere.
- CLI manifest: `collections = [...]` on `[group]` only (ManifestApp has no such
  field + deny_unknown_fields → an app manifest carrying it is a hard error);
  Manifest::collections() accessor; build_bundle emits it.
- plan/apply: a `collection` row group in `pic plan`; created/deleted counts in
  the apply summary; collections threaded through PlanDto/NodePlanDto/
  ApplyReportDto.
- read-only `pic collections ls --group` → GET /admin/groups/{id}/collections
  (viewer+), backed by ApplyService::collection_report + CollectionInfo.
- journey: a group declares `catalog`; app A writes, app B (same subtree) reads
  it back; a sibling-subtree app gets CollectionNotShared; `collections ls` +
  re-apply NoOp. Full suite 114/114.
- docs: groups-and-project-tool §11.6 (KV-only MVP shipped + deferrals),
  sdk-shape.md (the shared-collection handle + trust model), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/group_kv.rs

@@ -1,7 +1,7 @@
 //! `GroupKvService` — the §11.6 shared group-collection KV contract.
 //!
 //! The cross-app-sharing counterpart to [`crate::KvService`]. A script reaches
-//! it via the explicit `kv::shared("name")` handle (distinct from the
+//! it via the explicit `kv::shared_collection("name")` handle (distinct from the
 //! app-private `kv::collection("name")`). Unlike `KvService`, the *owner* of
 //! the data is not `cx.app_id`: the impl resolves the **owning group** by
 //! walking the calling app's ancestor chain for the nearest group that declares

crates/shared/src/services.rs

@@ -116,7 +116,7 @@ pub struct Services {
     pub vars: Arc<dyn VarsService>,
 
     /// Shared cross-app group collections (§11.6). Scripts get
-    /// `kv::shared(name)` — read/write KV scoped to the nearest ancestor
+    /// `kv::shared_collection(name)` — read/write KV scoped to the nearest ancestor
     /// group that declares the collection shared. Backed by Postgres in the
     /// picloud binary (wired via [`Services::with_group_kv`]); defaults to
     /// `NoopGroupKvService` so test bundles that don't exercise sharing build