feat(cli): pic triggers ls --group + group-template journeys + docs (§11 tail T4)

- apply_service: trigger_report(group) → TriggerTemplateInfo
  (kind/target/script/enabled); resolve_inherited_targets_for(Group) now
  surfaces the group's OWN endpoint scripts so a template's handler
  validates (fixes "binds to unknown script" when the handler is a
  pre-existing group script, not declared in the same manifest).
- apply_api: GET /groups/{id}/triggers (GroupScriptsRead).
- CLI: `pic triggers ls --group <g>` (--app/--group mutually exclusive)
  + the client method + DTO.
- tests/group_trigger_templates.rs (manager-core, live DB): the chain
  union matches a descendant app's kv insert against the group template
  and NOT a sibling subtree — the isolation boundary, deterministic.
- tests/group_triggers.rs (journey): apply a kv template, ls --group
  shows it, re-apply NoOp, cron-on-group rejected.
- docs: design §4.5 (live-event-kinds decision + deferrals), CLAUDE.md.

Full journey suite 119/119; workspace tests 0 failures; clippy -D clean;
schema unchanged (blessed in T1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/triggers.rs

@@ -40,6 +40,21 @@ pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
     Ok(())
 }
 
+/// `pic triggers ls --group <g>` — read-only view of a group's §11 tail trigger
+/// TEMPLATES (event kinds that fan out live to descendant apps). Authoring is
+/// declarative via the `[group]` manifest `[[triggers.*]]`.
+pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let rows = client.group_triggers_list(group).await?;
+    let mut table = Table::new(["kind", "target", "script", "enabled"]);
+    for t in rows {
+        table.row([t.kind, t.target, t.script, t.enabled.to_string()]);
+    }
+    table.print(mode);
+    Ok(())
+}
+
 pub async fn rm(app: &str, trigger_id: &str) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;