feat(shared-triggers): shared column on triggers (M2.1)

A group-owned trigger marked `shared = true` watches a §11.6 shared
collection instead of per-app collections — the namespace boundary that lets
a shared-collection write fire a trigger. Mirrors the sealed column; existing
rows default false (per-app, unchanged). Match-query split + emission land in
M2.2/M2.3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/expected_schema.txt

@@ -409,6 +409,7 @@ table: triggers
   name: text NOT NULL default=(gen_random_uuid())::text
   group_id: uuid NULL
   sealed: boolean NOT NULL default=false
+  shared: boolean NOT NULL default=false
 
 table: vars
   id: uuid NOT NULL default=gen_random_uuid()
@@ -940,3 +941,4 @@ constraints on vars:
   0058: template suppressions
   0059: sealed templates
   0060: group suppressions
+  0061: shared triggers