feat(shared-topics): thread the shared flag through pubsub triggers (D2)

Add `shared` to BundleTrigger::Pubsub + PubsubTriggerSpec + the trigger
identity (so toggling re-diffs) + current_trigger_identity. validate_bundle_for
now allows a `shared` pubsub trigger on a group and requires the topic
pattern's ROOT segment (events.* -> events) be a declared kind='topic'
collection; a wildcard root is a runtime match. Apply-side plumbing only —
the shared publish path + dispatch boundary land next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/pull.rs

@@ -207,7 +207,9 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     topic_pattern: d.topic_pattern,
                     dispatch_mode,
                     retry_max_attempts,
+                    // app-owned triggers are never sealed/shared (group-only).
                     sealed: false,
+                    shared: false,
                 });
             }
             "queue" => {

crates/picloud-cli/src/manifest.rs

@@ -487,6 +487,11 @@ pub struct PubsubTriggerSpec {
     /// See [`KvTriggerSpec::sealed`].
     #[serde(default, skip_serializing_if = "is_false")]
     pub sealed: bool,
+    /// §11.6 D2: `true` for a shared-TOPIC group trigger — fires when a subtree
+    /// app publishes to the group's declared shared topic, not on per-app
+    /// publishes. Group-only; requires a declared `kind = "topic"` collection.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub shared: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]