docs: reconcile the groups/project-tool initiative into the roadmap

The groups/project-tool work had no home in the blueprint's version
scheme, two "Phase N" numbering schemes overlapped, and CLAUDE.md's
"current focus" was stale (claimed v1.1.0 SDK foundation; we're at v1.1.9
with the SDK line complete). Reconcile all three:

* blueprint §12 Phase 5 (v1.2, already titled "Advanced Workflows &
  Hierarchies") — split into a Hierarchies track (the groups + project
  tool initiative, with §11 Phases 1–3 marked shipped) and a Workflows
  track, with sequencing flagged as an open call. This gives the work an
  explicit version home: the Hierarchies half of v1.2.
* design doc header — Status Draft → Active, "scheduled as the Hierarchies
  track of v1.2", and an explicit warning that §11's local Phase 1–6
  numbering is distinct from the blueprint product-phase numbering.
* design doc §11.1 — a post-Phase-3 re-sequencing review: resolve Phase 4
  scripts LIVE (drop the fan-out-invalidation sub-project, per the Phase 3
  result); consider a "Phase 5-lite" (declarative apply of vars/secrets +
  app scripts) before the hard group-scripts work; and force the two
  deferred decisions (trigger/route templates vs tenant cardinality;
  multi-repo ownership vs a single-repo start).
* CLAUDE.md — refresh "current focus" to v1.2 Hierarchies, and correct the
  now-broken "every v1.1+ table is app_id NOT NULL" invariant: the new
  group-inheritable config tables (vars, secrets) use a polymorphic owner
  (group_id XOR app_id), not app_id NOT NULL.

Doc-only; no code change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

serverless_cloud_blueprint.md

@@ -1256,6 +1256,28 @@ Released in patch steps (v1.1.0 → v1.1.8), each landing one focused capability
 ---
 
 ### Phase 5: v1.2 (Advanced Workflows & Hierarchies)
+
+Two tracks under the same minor line. The **Hierarchies** track is in active development; the
+**Workflows** track follows it (or runs in parallel — sequencing is an open call, see the design doc's
+§11 re-sequencing note).
+
+**Hierarchies — groups + the declarative project tool** (the detailed design and 6-phase breakdown
+live in [docs/design/groups-and-project-tool.md](../docs/design/groups-and-project-tool.md) §11; this
+absorbs the original one-line "Hierarchies" bullet into a full initiative):
+- A single-parent **groups** tree above apps, with hierarchy-aware RBAC (inherited membership). *(§11
+  Phase 2 — shipped: `0047_groups.sql`, `effective_app_role`/`effective_group_role`.)*
+- **Group-inherited, environment-scoped config** — `vars` + group secrets, resolved **live** (recursive
+  CTE, no materialized cache) with the §3 proximity/merge/tombstone rule; the group-secret AAD scheme;
+  masked secrets (an app runs with config its own devs cannot read). *(§11 Phase 3 — shipped:
+  `0048_vars.sql`, `0049_group_secrets.sql`.)*
+- A **declarative, file-based project tool** (`pic plan`/`apply`/`prune`, env overlays, the three-state
+  `enabled` lifecycle, bound-plan staleness check). *(§11 Phase 1 — shipped.)*
+- Remaining: group-owned **scripts/modules** with the scope-aware import resolver (§11 Phase 4); the
+  project tool **mapping onto the group tree** (nested manifests, attach points, ownership — §11 Phase
+  5). Group-level shared *data* (collections/topics) stays in v1.3 (the cross-app-sharing problem
+  below).
+
+**Workflows:**
 - Function workflows (DAG execution, conditional branching, error handling)
 - Nested workflows
 - Call graph visualization + execution tracing