feat(cli): pic triggers ls --group + group-template journeys + docs (§11 tail T4)

- apply_service: trigger_report(group) → TriggerTemplateInfo
  (kind/target/script/enabled); resolve_inherited_targets_for(Group) now
  surfaces the group's OWN endpoint scripts so a template's handler
  validates (fixes "binds to unknown script" when the handler is a
  pre-existing group script, not declared in the same manifest).
- apply_api: GET /groups/{id}/triggers (GroupScriptsRead).
- CLI: `pic triggers ls --group <g>` (--app/--group mutually exclusive)
  + the client method + DTO.
- tests/group_trigger_templates.rs (manager-core, live DB): the chain
  union matches a descendant app's kv insert against the group template
  and NOT a sibling subtree — the isolation boundary, deterministic.
- tests/group_triggers.rs (journey): apply a kv template, ls --group
  shows it, re-apply NoOp, cron-on-group rejected.
- docs: design §4.5 (live-event-kinds decision + deferrals), CLAUDE.md.

Full journey suite 119/119; workspace tests 0 failures; clippy -D clean;
schema unchanged (blessed in T1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/main.rs

@@ -891,10 +891,13 @@ enum RoutesCmd {
 
 #[derive(Subcommand)]
 enum TriggersCmd {
-    /// List every trigger in an app.
+    /// List an app's triggers, or a group's trigger TEMPLATES (`--group`).
     Ls {
+        #[arg(long, conflicts_with = "group", required_unless_present = "group")]
+        app: Option<String>,
+        /// List the group's §11 tail trigger templates instead.
         #[arg(long)]
-        app: String,
+        group: Option<String>,
     },
 
     /// Delete a trigger by id.
@@ -1706,8 +1709,12 @@ async fn main() -> ExitCode {
             cmd: AdminsCmd::Rm { id },
         } => cmds::admins::rm(&id).await,
         Cmd::Triggers {
-            cmd: TriggersCmd::Ls { app },
-        } => cmds::triggers::ls(&app, mode).await,
+            cmd: TriggersCmd::Ls { app, group },
+        } => match (app, group) {
+            (_, Some(group)) => cmds::triggers::ls_group(&group, mode).await,
+            (Some(app), None) => cmds::triggers::ls(&app, mode).await,
+            (None, None) => Err(anyhow::anyhow!("provide --app or --group")),
+        },
         Cmd::Triggers {
             cmd: TriggersCmd::Rm { app, trigger_id },
         } => cmds::triggers::rm(&app, &trigger_id).await,