feat(stateful-templates): journey + docs + concurrency fix; email deferred (M5.6)

- 0063: partial unique index on (app_id, materialized_from) + ON CONFLICT DO
  NOTHING in the reconciler, so a materialized copy is idempotent under
  concurrent reconciles (two parallel app-creates no longer duplicate a copy).
- stateful_templates journey: a group cron template + a descendant app → a
  materialized cron copy in `pic triggers ls --app`; re-apply is a NoOp.
- docs (§4.5 + CLAUDE.md): cron+queue materialization implemented; group EMAIL
  templates deferred (per-descendant inbound-secret reseal needs the master key
  threaded through the hooks + a secret-ref schema) and cleanly rejected at
  apply for now, alongside a `materialized` ls column.

Completes the v1.2 near-term batch (M1-M5, cron+queue); group email is the one
scoped follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/cli.rs

@@ -45,6 +45,7 @@ mod sealed;
 mod secrets;
 mod shared_triggers;
 mod staleness;
+mod stateful_templates;
 mod suppress;
 mod tree;
 mod triggers;

crates/picloud-cli/tests/stateful_templates.rs

@@ -0,0 +1,120 @@
+//! §4.5 M5 — stateful (cron/queue) group trigger templates, declarative end to
+//! end via `pic`. A group declares a cron template; applying it and creating a
+//! descendant app materializes a per-app cron copy (visible in `pic triggers ls
+//! --app`). The reconcile mechanism itself (per-app copy, idempotent,
+//! de-materialize on reparent, queue slot-conflict warning) is pinned
+//! deterministically by `manager-core/tests/stateful_templates.rs`; this journey
+//! exercises the CLI authoring plus the apply and app-create hooks.
+
+use std::fs;
+
+use tempfile::TempDir;
+
+use crate::common;
+use crate::common::cleanup::{AppGuard, GroupGuard, ScriptGuard};
+
+fn manifest_dir() -> TempDir {
+    let dir = TempDir::new().expect("tempdir");
+    fs::create_dir_all(dir.path().join("scripts")).expect("scripts dir");
+    dir
+}
+
+fn group_script_id(env: &common::TestEnv, group: &str, name: &str) -> String {
+    let ls = common::pic_as(env)
+        .args(["scripts", "ls", "--group", group])
+        .output()
+        .expect("scripts ls");
+    let table = String::from_utf8(ls.stdout).unwrap();
+    table
+        .lines()
+        .map(common::cells)
+        .find(|c| c.get(2) == Some(&name))
+        .and_then(|c| c.first().map(|s| (*s).to_string()))
+        .unwrap_or_else(|| panic!("group script `{name}` not found:\n{table}"))
+}
+
+/// Count `cron` rows in `pic triggers ls --app`.
+fn app_cron_count(env: &common::TestEnv, app: &str) -> usize {
+    let out = common::pic_as(env)
+        .args(["triggers", "ls", "--app", app])
+        .output()
+        .expect("triggers ls");
+    String::from_utf8(out.stdout)
+        .unwrap()
+        .lines()
+        .map(common::cells)
+        .filter(|c| c.contains(&"cron"))
+        .count()
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn group_cron_template_materializes_for_descendant_apps() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let group = common::unique_slug("mat-grp");
+
+    let _g = GroupGuard::new(&env.url, &env.token, &group);
+    common::pic_as(&env)
+        .args(["groups", "create", &group])
+        .assert()
+        .success();
+
+    // Group handler + a cron TEMPLATE binding it.
+    let dir = manifest_dir();
+    fs::write(
+        dir.path().join("scripts/nightly.rhai"),
+        r#"log::info("nightly"); "ok""#,
+    )
+    .unwrap();
+    common::pic_as(&env)
+        .args(["scripts", "deploy"])
+        .arg(dir.path().join("scripts/nightly.rhai"))
+        .args(["--group", &group, "--name", "nightly"])
+        .assert()
+        .success();
+    let _gs = ScriptGuard::new(
+        &env.url,
+        &env.token,
+        &group_script_id(&env, &group, "nightly"),
+    );
+    let gmanifest = format!(
+        "[group]\nslug = \"{group}\"\nname = \"MatG\"\n\n\
+         [[triggers.cron]]\nscript = \"nightly\"\nschedule = \"0 0 * * * *\"\n"
+    );
+    let gpath = dir.path().join("group.toml");
+    fs::write(&gpath, &gmanifest).unwrap();
+    common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&gpath)
+        .assert()
+        .success();
+
+    // An app created under the group materializes a per-app cron copy (the
+    // app-create hook reconciles).
+    let app = common::unique_slug("mat-app");
+    let _a = AppGuard::new(&env.url, &env.token, &app);
+    common::pic_as(&env)
+        .args(["apps", "create", &app, "--group", &group])
+        .assert()
+        .success();
+    assert_eq!(
+        app_cron_count(&env, &app),
+        1,
+        "a descendant app must have a materialized cron trigger"
+    );
+
+    // Re-apply of the group is a NoOp for materialization (no duplicate copy).
+    common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&gpath)
+        .assert()
+        .success();
+    assert_eq!(
+        app_cron_count(&env, &app),
+        1,
+        "re-apply must not duplicate the materialized copy"
+    );
+}