feat(modules): GroupKvService + kv::shared SDK handle (§11.6 C3)

The runtime for shared group collections. A script reaches a shared store via
the explicit kv::shared("name") handle (distinct GroupKvHandle Rhai type, so
private-vs-shared scope is a deliberate choice). The service resolves the
owning group from cx.app_id's ancestor chain — the script never names a group,
and that walk is the isolation boundary (a foreign app's chain never contains
the owning group → CollectionNotShared).

- shared: GroupKvService trait + GroupKvError + NoopGroupKvService; threaded
  into the Services bundle as a field defaulted to noop, opted into via a new
  with_group_kv() (keeps the ~14 Services::new call sites unchanged).
- manager-core: GroupKvServiceImpl with the reads-open/writes-authed split —
  reads use script_gate (anonymous public scripts skip), writes use the new
  script_gate_require_principal (anonymous fails closed). Owner resolution
  behind a GroupCollectionResolver trait (Postgres impl + injectable fake);
  unit tests cover off-chain CollectionNotShared, anonymous-read-OK/
  anonymous-write-Forbidden, authed-no-role-Forbidden.
- executor-core: GroupKvHandle + kv::shared constructor + get/set/has/delete/
  list (Rhai dispatches by receiver type, reusing the block_on bridge).
- picloud: wire PostgresGroupKvRepo + resolver + GroupKvServiceImpl.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -20,12 +20,12 @@
 use std::sync::Arc;
 
 use crate::{
-    DeadLetterService, DocsService, EmailService, FilesService, HttpService, InvokeService,
-    KvService, ModuleSource, NoopDeadLetterService, NoopDocsService, NoopEmailService,
-    NoopEventEmitter, NoopFilesService, NoopHttpService, NoopInvokeService, NoopKvService,
-    NoopModuleSource, NoopPubsubService, NoopQueueService, NoopSecretsService, NoopUsersService,
-    NoopVarsService, PubsubService, QueueService, SecretsService, ServiceEventEmitter,
-    UsersService, VarsService,
+    DeadLetterService, DocsService, EmailService, FilesService, GroupKvService, HttpService,
+    InvokeService, KvService, ModuleSource, NoopDeadLetterService, NoopDocsService,
+    NoopEmailService, NoopEventEmitter, NoopFilesService, NoopGroupKvService, NoopHttpService,
+    NoopInvokeService, NoopKvService, NoopModuleSource, NoopPubsubService, NoopQueueService,
+    NoopSecretsService, NoopUsersService, NoopVarsService, PubsubService, QueueService,
+    SecretsService, ServiceEventEmitter, UsersService, VarsService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -114,6 +114,14 @@ pub struct Services {
     /// (§3). Backed by `config_resolver` over Postgres in the picloud
     /// binary; `NoopVarsService` in tests that don't read config.
     pub vars: Arc<dyn VarsService>,
+
+    /// Shared cross-app group collections (§11.6). Scripts get
+    /// `kv::shared(name)` — read/write KV scoped to the nearest ancestor
+    /// group that declares the collection shared. Backed by Postgres in the
+    /// picloud binary (wired via [`Services::with_group_kv`]); defaults to
+    /// `NoopGroupKvService` so test bundles that don't exercise sharing build
+    /// unchanged.
+    pub group_kv: Arc<dyn GroupKvService>,
 }
 
 impl Services {
@@ -153,9 +161,21 @@ impl Services {
             queue,
             invoke,
             vars,
+            // §11.6 group collections default to noop; the picloud binary opts
+            // in via `with_group_kv`. Keeps the ~14 `Services::new` call sites
+            // (mostly tests) unchanged — a field addition, not a param.
+            group_kv: Arc::new(NoopGroupKvService),
         }
     }
 
+    /// Set the §11.6 shared group-collection service (the picloud binary wires
+    /// the Postgres-backed impl; tests leave the noop default).
+    #[must_use]
+    pub fn with_group_kv(mut self, group_kv: Arc<dyn GroupKvService>) -> Self {
+        self.group_kv = group_kv;
+        self
+    }
+
     /// All-noop bundle for tests that build an `Engine` but don't
     /// exercise the stateful services. Returns the same shape as
     /// `Services::new` so callers can't accidentally rely on a stub