feat(modules): GroupKvService + kv::shared SDK handle (§11.6 C3)

The runtime for shared group collections. A script reaches a shared store via
the explicit kv::shared("name") handle (distinct GroupKvHandle Rhai type, so
private-vs-shared scope is a deliberate choice). The service resolves the
owning group from cx.app_id's ancestor chain — the script never names a group,
and that walk is the isolation boundary (a foreign app's chain never contains
the owning group → CollectionNotShared).

- shared: GroupKvService trait + GroupKvError + NoopGroupKvService; threaded
  into the Services bundle as a field defaulted to noop, opted into via a new
  with_group_kv() (keeps the ~14 Services::new call sites unchanged).
- manager-core: GroupKvServiceImpl with the reads-open/writes-authed split —
  reads use script_gate (anonymous public scripts skip), writes use the new
  script_gate_require_principal (anonymous fails closed). Owner resolution
  behind a GroupCollectionResolver trait (Postgres impl + injectable fake);
  unit tests cover off-chain CollectionNotShared, anonymous-read-OK/
  anonymous-write-Forbidden, authed-no-role-Forbidden.
- executor-core: GroupKvHandle + kv::shared constructor + get/set/has/delete/
  list (Rhai dispatches by receiver type, reusing the block_on bridge).
- picloud: wire PostgresGroupKvRepo + resolver + GroupKvServiceImpl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/sdk/kv.rs

@@ -28,7 +28,7 @@
 
 use std::sync::Arc;
 
-use picloud_shared::{KvService, SdkCallCx, Services};
+use picloud_shared::{GroupKvService, KvService, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 
 use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
@@ -42,11 +42,25 @@ pub struct KvHandle {
     cx: Arc<SdkCallCx>,
 }
 
+/// §11.6 shared-collection handle, returned by `kv::shared(name)`. A distinct
+/// Rhai type from `KvHandle` so the method set can diverge (e.g. shared
+/// collections never grow triggers) and a script's choice of private-vs-shared
+/// scope is explicit. Routes through the `GroupKvService`, which resolves the
+/// owning group from `cx.app_id` (the script never names a group).
+#[derive(Clone)]
+pub struct GroupKvHandle {
+    collection: String,
+    service: Arc<dyn GroupKvService>,
+    cx: Arc<SdkCallCx>,
+}
+
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
     let kv_service = services.kv.clone();
+    let group_kv_service = services.group_kv.clone();
 
-    // `kv::collection(name)` — handle constructor lives in the `kv`
-    // static module so the script-visible call is `kv::collection(...)`.
+    // `kv::collection(name)` / `kv::shared(name)` — both constructors live in
+    // the `kv` static module so the script-visible calls are `kv::collection`
+    // and `kv::shared`.
     let mut module = Module::new();
     {
         let kv_service = kv_service.clone();
@@ -65,6 +79,23 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
             },
         );
     }
+    {
+        let group_kv_service = group_kv_service.clone();
+        let cx = cx.clone();
+        module.set_native_fn(
+            "shared",
+            move |name: &str| -> Result<GroupKvHandle, Box<EvalAltResult>> {
+                if name.is_empty() {
+                    return Err("kv::shared name must not be empty".into());
+                }
+                Ok(GroupKvHandle {
+                    collection: name.to_string(),
+                    service: group_kv_service.clone(),
+                    cx: cx.clone(),
+                })
+            },
+        );
+    }
     engine.register_static_module("kv", module.into());
 
     // Methods on KvHandle — `register_fn` with `&mut KvHandle` first
@@ -77,6 +108,15 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
     register_has(engine);
     register_delete(engine);
     register_list(engine);
+
+    // Same method names on GroupKvHandle — Rhai dispatches by receiver type.
+    engine.register_type_with_name::<GroupKvHandle>("GroupKvHandle");
+
+    register_group_get(engine);
+    register_group_set(engine);
+    register_group_has(engine);
+    register_group_delete(engine);
+    register_group_list(engine);
 }
 
 fn register_get(engine: &mut RhaiEngine) {
@@ -174,3 +214,98 @@ fn list_call(
     );
     Ok(m)
 }
+
+// --- GroupKvHandle methods (§11.6 shared collections) ----------------------
+
+fn register_group_get(engine: &mut RhaiEngine) {
+    engine.register_fn(
+        "get",
+        |handle: &mut GroupKvHandle, key: &str| -> Result<Dynamic, Box<EvalAltResult>> {
+            let h = handle.clone();
+            block_on("kv", async move {
+                h.service.get(&h.cx, &h.collection, key).await
+            })
+            .map(|opt| opt.map_or(Dynamic::UNIT, json_to_dynamic))
+        },
+    );
+}
+
+fn register_group_set(engine: &mut RhaiEngine) {
+    engine.register_fn(
+        "set",
+        |handle: &mut GroupKvHandle, key: &str, value: Dynamic| -> Result<(), Box<EvalAltResult>> {
+            let h = handle.clone();
+            let json = dynamic_to_json(&value);
+            block_on("kv", async move {
+                h.service.set(&h.cx, &h.collection, key, json).await
+            })
+        },
+    );
+}
+
+fn register_group_has(engine: &mut RhaiEngine) {
+    engine.register_fn(
+        "has",
+        |handle: &mut GroupKvHandle, key: &str| -> Result<bool, Box<EvalAltResult>> {
+            let h = handle.clone();
+            block_on("kv", async move {
+                h.service.has(&h.cx, &h.collection, key).await
+            })
+        },
+    );
+}
+
+fn register_group_delete(engine: &mut RhaiEngine) {
+    engine.register_fn(
+        "delete",
+        |handle: &mut GroupKvHandle, key: &str| -> Result<bool, Box<EvalAltResult>> {
+            let h = handle.clone();
+            block_on("kv", async move {
+                h.service.delete(&h.cx, &h.collection, key).await
+            })
+        },
+    );
+}
+
+fn register_group_list(engine: &mut RhaiEngine) {
+    engine.register_fn(
+        "list",
+        |handle: &mut GroupKvHandle| -> Result<Map, Box<EvalAltResult>> {
+            group_list_call(handle, None, 0)
+        },
+    );
+    engine.register_fn(
+        "list",
+        |handle: &mut GroupKvHandle, cursor: &str| -> Result<Map, Box<EvalAltResult>> {
+            group_list_call(handle, Some(cursor.to_string()), 0)
+        },
+    );
+    engine.register_fn(
+        "list",
+        |handle: &mut GroupKvHandle, cursor: &str, limit: i64| -> Result<Map, Box<EvalAltResult>> {
+            let limit = u32::try_from(limit.max(0)).unwrap_or(0);
+            group_list_call(handle, Some(cursor.to_string()), limit)
+        },
+    );
+}
+
+fn group_list_call(
+    handle: &GroupKvHandle,
+    cursor: Option<String>,
+    limit: u32,
+) -> Result<Map, Box<EvalAltResult>> {
+    let h = handle.clone();
+    let page = block_on("kv", async move {
+        h.service
+            .list(&h.cx, &h.collection, cursor.as_deref(), limit)
+            .await
+    })?;
+    let mut m = Map::new();
+    let keys: Array = page.keys.into_iter().map(Dynamic::from).collect();
+    m.insert("keys".into(), keys.into());
+    m.insert(
+        "next_cursor".into(),
+        page.next_cursor.map_or(Dynamic::UNIT, Dynamic::from),
+    );
+    Ok(m)
+}