feat(v1.1.5): pubsub::publish_durable SDK + pubsub:* triggers

Durable pub/sub through the universal outbox — the sixth trigger kind.

- `pubsub::publish_durable(topic, message)` Rhai SDK (no handle; topics
  ARE the grouping unit). Message JSON-encoded; Blobs base64 at any
  depth.
- `PubsubService` trait in picloud-shared with the topic matcher +
  validator (exact / `<prefix>.*` / `*`; mid-pattern wildcards
  rejected). `PostgresPubsubRepo` + `PubsubServiceImpl` in manager-core.
- Publish-time fan-out: one outbox row per matching enabled pubsub
  trigger, all in ONE transaction (no half-fan-out on crash). No
  matching trigger → publish succeeds silently, zero rows.
- `pubsub:*` trigger kind via Layout-E (0020: widen both CHECKs +
  pubsub_trigger_details + partial index), TriggerEvent::Pubsub +
  ctx.event.pubsub, dispatcher arm, admin endpoint POST /triggers/pubsub
  (validates topic pattern + reuses validate_trigger_target).
- AppPubsubPublish capability → script:write (seven-scope held).
- Dashboard Pub/Sub trigger form on the Triggers tab + list rendering.

publish_ephemeral stays deferred to v1.2. ~18 new tests (service
in-memory incl. transactional-rollback, shared matcher, bridge
encoding). No DB required for the suite.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/outbox_repo.rs

@@ -29,6 +29,8 @@ pub enum OutboxSourceKind {
     Cron,
     /// v1.1.5.
     Files,
+    /// v1.1.5.
+    Pubsub,
 }
 
 impl OutboxSourceKind {
@@ -41,6 +43,7 @@ impl OutboxSourceKind {
             Self::DeadLetter => "dead_letter",
             Self::Cron => "cron",
             Self::Files => "files",
+            Self::Pubsub => "pubsub",
         }
     }
 
@@ -53,6 +56,7 @@ impl OutboxSourceKind {
             "dead_letter" => Some(Self::DeadLetter),
             "cron" => Some(Self::Cron),
             "files" => Some(Self::Files),
+            "pubsub" => Some(Self::Pubsub),
             _ => None,
         }
     }