feat(shared-triggers): visibility + tests + docs (M2.5)

- `shared` column in `pic triggers ls --group` (TriggerTemplateInfo + DTO +
  report + renderer).
- manager-core/tests/shared_triggers.rs: a shared write matches the group's
  shared trigger and NOT a same-named per-app trigger; a per-app write matches
  the app trigger and NOT the shared one (the `shared` flag is the boundary).
- shared_triggers journey: declarative authoring applies, ls --group shows
  shared, an undeclared-collection shared trigger + an app shared trigger are
  rejected.
- docs: §11.6 + CLAUDE.md move shared-collection triggers from Deferred to
  implemented.

Completes M2. (Pre-existing async-dispatcher timing flakes pass in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1421,6 +1421,9 @@ pub struct TriggerTemplateDto {
     /// §11 tail: `true` for a sealed (non-suppressible) template.
     #[serde(default)]
     pub sealed: bool,
+    /// §11.6: `true` for a shared-collection template.
+    #[serde(default)]
+    pub shared: bool,
 }
 
 /// One row of the §11 tail route-template report.