feat(modules): GroupFilesService + files::shared_collection handle (§11.6 files C3)

- shared/group_files: GroupFilesService trait (mirror FilesService, no
  group id arg — owner resolved from cx.app_id), GroupFilesError (clone of
  FilesError + CollectionNotShared) with From<FilesError>, Noop.
- services: group_files field + with_group_files setter (default Noop).
- group_files_service: GroupFilesServiceImpl — owning_group via the
  registry resolver (kind=files) → CollectionNotShared; reads open
  (script_gate), writes fail closed (script_gate_require_principal);
  reuses validate_files_collection + the NewFile/FileUpdate validators +
  sanitize_stored_content_type + the per-file size cap; no events.
- sdk/files: GroupFilesHandle + files::shared_collection(name) + the
  create/head/get/update/delete/list group methods (Blob in/out).
- picloud: construct FsGroupFilesRepo (sharing the files root + size cap)
  + GroupFilesServiceImpl, .with_group_files(...).

Unit tests: off-chain → CollectionNotShared; anon read OK / anon write
Forbidden; oversize → TooLarge.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/services.rs

@@ -20,12 +20,13 @@
 use std::sync::Arc;
 
 use crate::{
-    DeadLetterService, DocsService, EmailService, FilesService, GroupDocsService, GroupKvService,
-    HttpService, InvokeService, KvService, ModuleSource, NoopDeadLetterService, NoopDocsService,
-    NoopEmailService, NoopEventEmitter, NoopFilesService, NoopGroupDocsService, NoopGroupKvService,
-    NoopHttpService, NoopInvokeService, NoopKvService, NoopModuleSource, NoopPubsubService,
-    NoopQueueService, NoopSecretsService, NoopUsersService, NoopVarsService, PubsubService,
-    QueueService, SecretsService, ServiceEventEmitter, UsersService, VarsService,
+    DeadLetterService, DocsService, EmailService, FilesService, GroupDocsService,
+    GroupFilesService, GroupKvService, HttpService, InvokeService, KvService, ModuleSource,
+    NoopDeadLetterService, NoopDocsService, NoopEmailService, NoopEventEmitter, NoopFilesService,
+    NoopGroupDocsService, NoopGroupFilesService, NoopGroupKvService, NoopHttpService,
+    NoopInvokeService, NoopKvService, NoopModuleSource, NoopPubsubService, NoopQueueService,
+    NoopSecretsService, NoopUsersService, NoopVarsService, PubsubService, QueueService,
+    SecretsService, ServiceEventEmitter, UsersService, VarsService,
 };
 
 /// SDK service bundle. See module docs for the lifecycle and the v1.1.x
@@ -127,6 +128,11 @@ pub struct Services {
     /// `docs::shared_collection(name)`. Wired via [`Services::with_group_docs`];
     /// defaults to `NoopGroupDocsService`.
     pub group_docs: Arc<dyn GroupDocsService>,
+
+    /// Shared cross-app group FILES collections (§11.6). Scripts get
+    /// `files::shared_collection(name)`. Wired via [`Services::with_group_files`];
+    /// defaults to `NoopGroupFilesService`.
+    pub group_files: Arc<dyn GroupFilesService>,
 }
 
 impl Services {
@@ -171,6 +177,7 @@ impl Services {
             // (mostly tests) unchanged — a field addition, not a param.
             group_kv: Arc::new(NoopGroupKvService),
             group_docs: Arc::new(NoopGroupDocsService),
+            group_files: Arc::new(NoopGroupFilesService),
         }
     }
 
@@ -189,6 +196,13 @@ impl Services {
         self
     }
 
+    /// Set the §11.6 shared group-FILES service (picloud binary; tests leave noop).
+    #[must_use]
+    pub fn with_group_files(mut self, group_files: Arc<dyn GroupFilesService>) -> Self {
+        self.group_files = group_files;
+        self
+    }
+
     /// All-noop bundle for tests that build an `Engine` but don't
     /// exercise the stateful services. Returns the same shape as
     /// `Services::new` so callers can't accidentally rely on a stub