test(cli): shared-docs journey + docs (§11.6 docs C5)

End-to-end docs journey: a group declares a kv AND a docs collection via the
string-or-table manifest; an authenticated app A docs::shared_collection(
"articles").create(#{...}), app B finds it back across the subtree (exercising
the shared find DSL); a sibling-subtree app gets CollectionNotShared;
collections ls shows both kinds; re-apply NoOp. Full journey suite 116/116.

Docs: groups-and-project-tool §11.6 (KV+docs slices shipped; files/topics/queue
deferred), sdk-shape.md (docs::shared_collection + string-or-table), CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/sdk-shape.md

@@ -99,6 +99,15 @@ script. **Reads** are open to any subtree script (including anonymous
 public endpoints — declaring the collection *is* the grant); **writes**
 require an authenticated principal with editor+ on the owning group.
 
+**Docs too.** The same handle exists for the queryable-JSON store:
+`docs::shared_collection("articles")` returns a shared-docs handle with the
+full `create`/`get`/`find`/`find_one`/`update`/`delete`/`list` surface (same
+trust model + isolation boundary as the KV one). A `[group]` declares a
+collection's store with a kind: `collections = ["catalog", { name =
+"articles", kind = "docs" }]` — a bare string is `kv`, a `{ name, kind }`
+table sets it. A `kv` and a `docs` collection of the same name are distinct
+stores. (Files/topics/queue shared collections are not yet implemented.)
+
 ## Error convention
 
 - **Throw on failure.** `widgets.set("k", "v")` throws a Rhai runtime