feat(shared-triggers): visibility + tests + docs (M2.5)

- `shared` column in `pic triggers ls --group` (TriggerTemplateInfo + DTO +
  report + renderer).
- manager-core/tests/shared_triggers.rs: a shared write matches the group's
  shared trigger and NOT a same-named per-app trigger; a per-app write matches
  the app trigger and NOT the shared one (the `shared` flag is the boundary).
- shared_triggers journey: declarative authoring applies, ls --group shows
  shared, an undeclared-collection shared trigger + an app shared trigger are
  rejected.
- docs: §11.6 + CLAUDE.md move shared-collection triggers from Deferred to
  implemented.

Completes M2. (Pre-existing async-dispatcher timing flakes pass in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -575,6 +575,8 @@ pub struct TriggerTemplateInfo {
     pub enabled: bool,
     /// §11 tail: `true` for a sealed (non-suppressible) template.
     pub sealed: bool,
+    /// §11.6: `true` for a shared-collection template.
+    pub shared: bool,
 }
 
 /// One row of the read-only §11 tail route-template report (`pic routes ls
@@ -2173,6 +2175,7 @@ impl ApplyService {
                     script: name_by_id.get(&t.script_id).cloned().unwrap_or_default(),
                     enabled: t.enabled,
                     sealed: t.sealed,
+                    shared: t.shared,
                 }
             })
             .collect())