feat(shared-topics): thread the shared flag through pubsub triggers (D2)

Add `shared` to BundleTrigger::Pubsub + PubsubTriggerSpec + the trigger
identity (so toggling re-diffs) + current_trigger_identity. validate_bundle_for
now allows a `shared` pubsub trigger on a group and requires the topic
pattern's ROOT segment (events.* -> events) be a declared kind='topic'
collection; a wildcard root is a runtime match. Apply-side plumbing only —
the shared publish path + dispatch boundary land next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/pull.rs

@@ -207,7 +207,9 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     topic_pattern: d.topic_pattern,
                     dispatch_mode,
                     retry_max_attempts,
+                    // app-owned triggers are never sealed/shared (group-only).
                     sealed: false,
+                    shared: false,
                 });
             }
             "queue" => {