feat(cli): pic triggers ls --group + group-template journeys + docs (§11 tail T4)

- apply_service: trigger_report(group) → TriggerTemplateInfo
  (kind/target/script/enabled); resolve_inherited_targets_for(Group) now
  surfaces the group's OWN endpoint scripts so a template's handler
  validates (fixes "binds to unknown script" when the handler is a
  pre-existing group script, not declared in the same manifest).
- apply_api: GET /groups/{id}/triggers (GroupScriptsRead).
- CLI: `pic triggers ls --group <g>` (--app/--group mutually exclusive)
  + the client method + DTO.
- tests/group_trigger_templates.rs (manager-core, live DB): the chain
  union matches a descendant app's kv insert against the group template
  and NOT a sibling subtree — the isolation boundary, deterministic.
- tests/group_triggers.rs (journey): apply a kv template, ls --group
  shows it, re-apply NoOp, cron-on-group rejected.
- docs: design §4.5 (live-event-kinds decision + deferrals), CLAUDE.md.

Full journey suite 119/119; workspace tests 0 failures; clippy -D clean;
schema unchanged (blessed in T1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -461,6 +461,17 @@ pub struct CollectionInfo {
     pub kind: String,
 }
 
+/// One row of the read-only §11 tail trigger-template report (`pic triggers ls
+/// --group`). `target` is the kind-specific identity bit (collection glob or
+/// topic pattern); `script` is the handler script's name.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct TriggerTemplateInfo {
+    pub kind: String,
+    pub target: String,
+    pub script: String,
+    pub enabled: bool,
+}
+
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
@@ -569,7 +580,42 @@ impl ApplyService {
     ) -> Result<HashMap<String, ScriptId>, ApplyError> {
         match owner {
             ApplyOwner::App(app_id) => self.resolve_inherited_targets(app_id, bundle).await,
-            ApplyOwner::Group(_) => Ok(HashMap::new()),
+            // §11 tail: a group trigger TEMPLATE binds the group's OWN endpoint
+            // scripts (declared here or pre-existing). Surface the ones a
+            // template references but the bundle doesn't declare, so
+            // `validate_bundle` accepts them (the reconcile's name_to_id already
+            // includes the group's current scripts).
+            ApplyOwner::Group(group_id) => {
+                let declared: HashSet<String> = bundle
+                    .scripts
+                    .iter()
+                    .map(|s| s.name.to_lowercase())
+                    .collect();
+                let referenced: HashSet<String> = bundle
+                    .triggers
+                    .iter()
+                    .map(|t| t.script().to_lowercase())
+                    .collect();
+                let by_name: HashMap<String, ScriptId> = self
+                    .scripts
+                    .list_for_group(group_id)
+                    .await
+                    .map_err(map_repo)?
+                    .into_iter()
+                    .filter(|s| s.kind == ScriptKind::Endpoint)
+                    .map(|s| (s.name.to_lowercase(), s.id))
+                    .collect();
+                let mut out = HashMap::new();
+                for name in referenced {
+                    if declared.contains(&name) {
+                        continue;
+                    }
+                    if let Some(id) = by_name.get(&name) {
+                        out.insert(name, *id);
+                    }
+                }
+                Ok(out)
+            }
         }
     }
 
@@ -1842,6 +1888,58 @@ impl ApplyService {
     /// collections (`name` + `kind`) declared directly at it. Group-only in
     /// practice (the CLI rejects app-declared collections). Backs
     /// `pic collections ls`.
+    /// Read-only §11 tail report: a group's own trigger TEMPLATES, surfaced as
+    /// (kind, target, handler script name, enabled). The stored `name` is a UUID
+    /// default for reconcile-created rows, so the semantic bits are shown
+    /// instead. Backs `pic triggers ls --group`.
+    pub async fn trigger_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<TriggerTemplateInfo>, ApplyError> {
+        let ApplyOwner::Group(group_id) = owner else {
+            return Ok(Vec::new());
+        };
+        let triggers = self
+            .triggers
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let scripts = self
+            .scripts
+            .list_for_group(group_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let name_by_id: HashMap<ScriptId, String> =
+            scripts.iter().map(|s| (s.id, s.name.clone())).collect();
+        Ok(triggers
+            .into_iter()
+            .map(|t| {
+                let (kind, target) = match &t.details {
+                    TriggerDetails::Kv {
+                        collection_glob, ..
+                    } => ("kv", collection_glob.clone()),
+                    TriggerDetails::Docs {
+                        collection_glob, ..
+                    } => ("docs", collection_glob.clone()),
+                    TriggerDetails::Files {
+                        collection_glob, ..
+                    } => ("files", collection_glob.clone()),
+                    TriggerDetails::Pubsub { topic_pattern } => ("pubsub", topic_pattern.clone()),
+                    TriggerDetails::Cron { .. } => ("cron", String::new()),
+                    TriggerDetails::Queue { queue_name, .. } => ("queue", queue_name.clone()),
+                    TriggerDetails::Email { .. } => ("email", String::new()),
+                    TriggerDetails::DeadLetter { .. } => ("dead_letter", String::new()),
+                };
+                TriggerTemplateInfo {
+                    kind: kind.to_string(),
+                    target,
+                    script: name_by_id.get(&t.script_id).cloned().unwrap_or_default(),
+                    enabled: t.enabled,
+                }
+            })
+            .collect())
+    }
+
     pub async fn collection_report(
         &self,
         owner: ApplyOwner,