feat(v1.1.5): pubsub::publish_durable SDK + pubsub:* triggers

Durable pub/sub through the universal outbox — the sixth trigger kind.

- `pubsub::publish_durable(topic, message)` Rhai SDK (no handle; topics
  ARE the grouping unit). Message JSON-encoded; Blobs base64 at any
  depth.
- `PubsubService` trait in picloud-shared with the topic matcher +
  validator (exact / `<prefix>.*` / `*`; mid-pattern wildcards
  rejected). `PostgresPubsubRepo` + `PubsubServiceImpl` in manager-core.
- Publish-time fan-out: one outbox row per matching enabled pubsub
  trigger, all in ONE transaction (no half-fan-out on crash). No
  matching trigger → publish succeeds silently, zero rows.
- `pubsub:*` trigger kind via Layout-E (0020: widen both CHECKs +
  pubsub_trigger_details + partial index), TriggerEvent::Pubsub +
  ctx.event.pubsub, dispatcher arm, admin endpoint POST /triggers/pubsub
  (validates topic pattern + reuses validate_trigger_target).
- AppPubsubPublish capability → script:write (seven-scope held).
- Dashboard Pub/Sub trigger form on the Triggers tab + list rendering.

publish_ephemeral stays deferred to v1.2. ~18 new tests (service
in-memory incl. transactional-rollback, shared matcher, bridge
encoding). No DB required for the suite.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/trigger_repo.rs

@@ -55,6 +55,8 @@ pub enum TriggerKind {
     Cron,
     /// v1.1.5.
     Files,
+    /// v1.1.5.
+    Pubsub,
 }
 
 impl TriggerKind {
@@ -66,6 +68,7 @@ impl TriggerKind {
             Self::DeadLetter => "dead_letter",
             Self::Cron => "cron",
             Self::Files => "files",
+            Self::Pubsub => "pubsub",
         }
     }
 
@@ -77,6 +80,7 @@ impl TriggerKind {
             "dead_letter" => Some(Self::DeadLetter),
             "cron" => Some(Self::Cron),
             "files" => Some(Self::Files),
+            "pubsub" => Some(Self::Pubsub),
             _ => None,
         }
     }
@@ -131,6 +135,8 @@ pub enum TriggerDetails {
         collection_glob: String,
         ops: Vec<FilesEventOp>,
     },
+    /// v1.1.5. A topic pattern: exact, `<prefix>.*`, or `*`.
+    Pubsub { topic_pattern: String },
 }
 
 /// Create payload for a KV trigger. Defaults applied at the admin
@@ -213,6 +219,19 @@ pub struct FilesTriggerMatch {
     pub registered_by_principal: AdminUserId,
 }
 
+/// Create payload for a pubsub trigger (v1.1.5). `topic_pattern` is
+/// validated (exact / `<prefix>.*` / `*`) before insert.
+#[derive(Debug, Clone)]
+pub struct CreatePubsubTrigger {
+    pub script_id: ScriptId,
+    pub topic_pattern: String,
+    pub dispatch_mode: TriggerDispatchMode,
+    pub retry_max_attempts: u32,
+    pub retry_backoff: BackoffShape,
+    pub retry_base_ms: u32,
+    pub registered_by_principal: AdminUserId,
+}
+
 /// One match for the dispatcher's "which KV triggers fire on this
 /// event" lookup. Carries everything the dispatcher needs to construct
 /// the outbox row.
@@ -287,6 +306,13 @@ pub trait TriggerRepo: Send + Sync {
         req: CreateFilesTrigger,
     ) -> Result<Trigger, TriggerRepoError>;
 
+    /// v1.1.5. `topic_pattern` is validated before insert.
+    async fn create_pubsub_trigger(
+        &self,
+        app_id: AppId,
+        req: CreatePubsubTrigger,
+    ) -> Result<Trigger, TriggerRepoError>;
+
     async fn list_for_app(&self, app_id: AppId) -> Result<Vec<Trigger>, TriggerRepoError>;
 
     async fn get(&self, id: TriggerId) -> Result<Option<Trigger>, TriggerRepoError>;
@@ -675,6 +701,66 @@ impl TriggerRepo for PostgresTriggerRepo {
         })
     }
 
+    async fn create_pubsub_trigger(
+        &self,
+        app_id: AppId,
+        req: CreatePubsubTrigger,
+    ) -> Result<Trigger, TriggerRepoError> {
+        // Defense-in-depth validation (the admin endpoint validates too).
+        picloud_shared::validate_topic_pattern(&req.topic_pattern)
+            .map_err(TriggerRepoError::Invalid)?;
+
+        let mut tx = self.pool.begin().await?;
+        let parent: TriggerRow = sqlx::query_as(
+            "INSERT INTO triggers ( \
+                app_id, script_id, kind, enabled, dispatch_mode, \
+                retry_max_attempts, retry_backoff, retry_base_ms, \
+                registered_by_principal \
+             ) VALUES ($1, $2, 'pubsub', TRUE, $3, $4, $5, $6, $7) \
+             RETURNING id, app_id, script_id, kind, enabled, dispatch_mode, \
+                       retry_max_attempts, retry_backoff, retry_base_ms, \
+                       registered_by_principal, created_at, updated_at",
+        )
+        .bind(app_id.into_inner())
+        .bind(req.script_id.into_inner())
+        .bind(req.dispatch_mode.as_str())
+        .bind(i32::try_from(req.retry_max_attempts).unwrap_or(3))
+        .bind(req.retry_backoff.as_str())
+        .bind(i32::try_from(req.retry_base_ms).unwrap_or(1000))
+        .bind(req.registered_by_principal.into_inner())
+        .fetch_one(&mut *tx)
+        .await?;
+
+        sqlx::query(
+            "INSERT INTO pubsub_trigger_details (trigger_id, topic_pattern) VALUES ($1, $2)",
+        )
+        .bind(parent.id)
+        .bind(&req.topic_pattern)
+        .execute(&mut *tx)
+        .await?;
+
+        tx.commit().await?;
+
+        Ok(Trigger {
+            id: parent.id.into(),
+            app_id: parent.app_id.into(),
+            script_id: parent.script_id.into(),
+            kind: TriggerKind::Pubsub,
+            enabled: parent.enabled,
+            dispatch_mode: dispatch_from_str(&parent.dispatch_mode),
+            retry_max_attempts: u32::try_from(parent.retry_max_attempts).unwrap_or(3),
+            retry_backoff: BackoffShape::from_wire(&parent.retry_backoff)
+                .unwrap_or(BackoffShape::Exponential),
+            retry_base_ms: u32::try_from(parent.retry_base_ms).unwrap_or(1000),
+            registered_by_principal: parent.registered_by_principal.into(),
+            created_at: parent.created_at,
+            updated_at: parent.updated_at,
+            details: TriggerDetails::Pubsub {
+                topic_pattern: req.topic_pattern,
+            },
+        })
+    }
+
     async fn list_for_app(&self, app_id: AppId) -> Result<Vec<Trigger>, TriggerRepoError> {
         let parents: Vec<TriggerRow> = sqlx::query_as(
             "SELECT id, app_id, script_id, kind, enabled, dispatch_mode, \
@@ -980,6 +1066,17 @@ async fn hydrate_one(pool: &PgPool, parent: TriggerRow) -> Result<Trigger, Trigg
                 ops,
             }
         }
+        TriggerKind::Pubsub => {
+            let row: PubsubDetailRow = sqlx::query_as(
+                "SELECT topic_pattern FROM pubsub_trigger_details WHERE trigger_id = $1",
+            )
+            .bind(parent.id)
+            .fetch_one(pool)
+            .await?;
+            TriggerDetails::Pubsub {
+                topic_pattern: row.topic_pattern,
+            }
+        }
     };
 
     Ok(Trigger {
@@ -1052,6 +1149,11 @@ struct CronDetailRow {
     last_fired_at: Option<DateTime<Utc>>,
 }
 
+#[derive(sqlx::FromRow)]
+struct PubsubDetailRow {
+    topic_pattern: String,
+}
+
 #[derive(sqlx::FromRow)]
 #[allow(clippy::struct_field_names)]
 struct DlDetailRow {