feat(stateful-templates): schema + dispatch guards + allow cron/queue on group (M5.1)

0062 adds `materialized_from` on triggers (a managed app-owned copy links back
to its group template; CASCADE). The scheduler + queue-consumer queries gain
`AND t.app_id IS NOT NULL` so a group-owned stateful TEMPLATE is never
dispatched directly — only the per-descendant materialized app rows are.
validate_bundle_for + manifest parse now allow cron/queue on a group (email
stays rejected pending its per-app inbound-secret handling in M5.5). The
materialization reconcile that expands templates into app rows lands in M5.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/trigger_repo.rs

@@ -1769,7 +1769,8 @@ impl TriggerRepo for PostgresTriggerRepo {
              FROM triggers t \
              JOIN queue_trigger_details d ON d.trigger_id = t.id \
              JOIN scripts s ON s.id = t.script_id \
-             WHERE t.kind = 'queue' AND t.enabled = TRUE AND s.enabled = TRUE",
+             WHERE t.kind = 'queue' AND t.enabled = TRUE AND s.enabled = TRUE \
+               AND t.app_id IS NOT NULL",
         )
         .fetch_all(&self.pool)
         .await?;