feat(vars): VarsService + vars:: SDK + config capabilities

Scripts can now read group-inherited config via vars::get(key) / vars::all().

- shared: VarsService trait (read-only get/all) + NoopVarsService; added as
  the 14th field on the Services bundle.
- manager-core: VarsServiceImpl resolves the calling app's config via
  config_resolver (derives app_id from cx.app_id; AppVarsRead-gated for
  authed principals, script-as-gate for anon).
- executor-core: vars:: Rhai bridge (get/all), registered in the SDK.
- authz: AppVarsRead/Write, GroupVarsRead/Write, GroupSecretsRead/Write
  capabilities (group caps resolve via the Phase-2 ancestor walk; the
  GroupSecretsRead human-read gate is group_admin-only, distinct from an
  app's runtime injection).
- wired VarsServiceImpl into the picloud binary; updated the executor-core
  test Services::new call sites.

386 manager-core lib tests green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -24,7 +24,8 @@ use crate::{
     KvService, ModuleSource, NoopDeadLetterService, NoopDocsService, NoopEmailService,
     NoopEventEmitter, NoopFilesService, NoopHttpService, NoopInvokeService, NoopKvService,
     NoopModuleSource, NoopPubsubService, NoopQueueService, NoopSecretsService, NoopUsersService,
-    PubsubService, QueueService, SecretsService, ServiceEventEmitter, UsersService,
+    NoopVarsService, PubsubService, QueueService, SecretsService, ServiceEventEmitter,
+    UsersService, VarsService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -107,6 +108,12 @@ pub struct Services {
     /// and `invoke_async()` (fire-and-forget through the outbox).
     /// Cross-app invokes are rejected at the service entry point.
     pub invoke: Arc<dyn InvokeService>,
+
+    /// Group-inherited, env-scoped config (Phase 3). Scripts get
+    /// read-only `vars::{get,all}`; values resolve down the group tree
+    /// (§3). Backed by `config_resolver` over Postgres in the picloud
+    /// binary; `NoopVarsService` in tests that don't read config.
+    pub vars: Arc<dyn VarsService>,
 }
 
 impl Services {
@@ -129,6 +136,7 @@ impl Services {
         users: Arc<dyn UsersService>,
         queue: Arc<dyn QueueService>,
         invoke: Arc<dyn InvokeService>,
+        vars: Arc<dyn VarsService>,
     ) -> Self {
         Self {
             kv,
@@ -144,6 +152,7 @@ impl Services {
             users,
             queue,
             invoke,
+            vars,
         }
     }
 
@@ -168,6 +177,7 @@ impl Services {
             Arc::new(NoopUsersService),
             Arc::new(NoopQueueService),
             Arc::new(NoopInvokeService),
+            Arc::new(NoopVarsService),
         )
     }
 }