feat(shared-triggers): visibility + tests + docs (M2.5)

- `shared` column in `pic triggers ls --group` (TriggerTemplateInfo + DTO +
  report + renderer).
- manager-core/tests/shared_triggers.rs: a shared write matches the group's
  shared trigger and NOT a same-named per-app trigger; a per-app write matches
  the app trigger and NOT the shared one (the `shared` flag is the boundary).
- shared_triggers journey: declarative authoring applies, ls --group shows
  shared, an undeclared-collection shared trigger + an app shared trigger are
  rejected.
- docs: §11.6 + CLAUDE.md move shared-collection triggers from Deferred to
  implemented.

Completes M2. (Pre-existing async-dispatcher timing flakes pass in isolation.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/triggers.rs

@@ -47,7 +47,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
     let rows = client.group_triggers_list(group).await?;
-    let mut table = Table::new(["kind", "target", "script", "enabled", "sealed"]);
+    let mut table = Table::new(["kind", "target", "script", "enabled", "sealed", "shared"]);
     for t in rows {
         table.row([
             t.kind,
@@ -55,6 +55,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
             t.script,
             t.enabled.to_string(),
             t.sealed.to_string(),
+            t.shared.to_string(),
         ]);
     }
     table.print(mode);