feat(modules): GroupDocsService + docs::shared_collection handle (§11.6 docs C3)

The runtime for shared group docs collections, mirroring the group-KV vertical
with the docs surface (filter parsing, JSON-object validation, value-size cap).

- shared: GroupDocsService trait + GroupDocsError (+ CollectionNotShared) +
  NoopGroupDocsService; group_docs field on Services + with_group_docs().
- manager-core: GroupDocsServiceImpl — owning_group resolves kind='docs' from
  cx.app_id's chain (CollectionNotShared off-chain); reads-open (script_gate
  GroupDocsRead) / writes-authed (script_gate_require_principal GroupDocsWrite);
  reuses parse_filter + docs value-size cap; no events. Unit tests cover
  off-chain CollectionNotShared, anon-read-OK/anon-write-Forbidden, non-object
  data rejected.
- executor-core: GroupDocsHandle + docs::shared_collection constructor + the
  create/get/find/find_one/update/delete/list methods (dispatch by receiver
  type), reusing doc_to_map/parse_doc_id.
- picloud: wire PostgresGroupDocsRepo + GroupDocsServiceImpl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -20,12 +20,12 @@
 use std::sync::Arc;
 
 use crate::{
-    DeadLetterService, DocsService, EmailService, FilesService, GroupKvService, HttpService,
-    InvokeService, KvService, ModuleSource, NoopDeadLetterService, NoopDocsService,
-    NoopEmailService, NoopEventEmitter, NoopFilesService, NoopGroupKvService, NoopHttpService,
-    NoopInvokeService, NoopKvService, NoopModuleSource, NoopPubsubService, NoopQueueService,
-    NoopSecretsService, NoopUsersService, NoopVarsService, PubsubService, QueueService,
-    SecretsService, ServiceEventEmitter, UsersService, VarsService,
+    DeadLetterService, DocsService, EmailService, FilesService, GroupDocsService, GroupKvService,
+    HttpService, InvokeService, KvService, ModuleSource, NoopDeadLetterService, NoopDocsService,
+    NoopEmailService, NoopEventEmitter, NoopFilesService, NoopGroupDocsService, NoopGroupKvService,
+    NoopHttpService, NoopInvokeService, NoopKvService, NoopModuleSource, NoopPubsubService,
+    NoopQueueService, NoopSecretsService, NoopUsersService, NoopVarsService, PubsubService,
+    QueueService, SecretsService, ServiceEventEmitter, UsersService, VarsService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -122,6 +122,11 @@ pub struct Services {
     /// `NoopGroupKvService` so test bundles that don't exercise sharing build
     /// unchanged.
     pub group_kv: Arc<dyn GroupKvService>,
+
+    /// Shared cross-app group DOCS collections (§11.6). Scripts get
+    /// `docs::shared_collection(name)`. Wired via [`Services::with_group_docs`];
+    /// defaults to `NoopGroupDocsService`.
+    pub group_docs: Arc<dyn GroupDocsService>,
 }
 
 impl Services {
@@ -165,17 +170,25 @@ impl Services {
             // in via `with_group_kv`. Keeps the ~14 `Services::new` call sites
             // (mostly tests) unchanged — a field addition, not a param.
             group_kv: Arc::new(NoopGroupKvService),
+            group_docs: Arc::new(NoopGroupDocsService),
         }
     }
 
-    /// Set the §11.6 shared group-collection service (the picloud binary wires
-    /// the Postgres-backed impl; tests leave the noop default).
+    /// Set the §11.6 shared group-KV service (the picloud binary wires the
+    /// Postgres-backed impl; tests leave the noop default).
     #[must_use]
     pub fn with_group_kv(mut self, group_kv: Arc<dyn GroupKvService>) -> Self {
         self.group_kv = group_kv;
         self
     }
 
+    /// Set the §11.6 shared group-DOCS service (picloud binary; tests leave noop).
+    #[must_use]
+    pub fn with_group_docs(mut self, group_docs: Arc<dyn GroupDocsService>) -> Self {
+        self.group_docs = group_docs;
+        self
+    }
+
     /// All-noop bundle for tests that build an `Engine` but don't
     /// exercise the stateful services. Returns the same shape as
     /// `Services::new` so callers can't accidentally rely on a stub