feat(sealed): sealed column on triggers + routes (§11 tail M1)

A group template can be marked `sealed = true` so the per-app suppression
filters skip it — closing the advisory-by-default compliance footgun the
suppression review flagged. Only meaningful on a group-owned template;
existing rows default unsealed. Consumption gates land in M3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/migrations/0059_sealed_templates.sql

@@ -0,0 +1,19 @@
+-- §11 tail (v1.2 Hierarchies): `sealed` (mandatory) group templates.
+--
+-- Per-app opt-out (0058_template_suppressions) made an inherited group TRIGGER
+-- or ROUTE template advisory-by-default: it runs on a descendant *unless* that
+-- descendant declares a `[suppress]` declining it. That is a compliance footgun
+-- — a group's audit / security / rate-limit template can be silently opted out
+-- of by the very tenant it is meant to police.
+--
+-- A `sealed` template closes the gap: the two suppression filters skip a sealed
+-- row, so it fires / serves on every descendant regardless of any suppression.
+-- The column is only meaningful on a group-owned template (`group_id IS NOT
+-- NULL`); an app-owned row is never inherited, so sealing it is meaningless and
+-- rejected at apply. Existing rows default to unsealed (the prior behaviour).
+--
+--   * triggers.sealed — a sealed group trigger template is never suppressible.
+--   * routes.sealed   — a sealed group route template is never suppressible.
+
+ALTER TABLE triggers ADD COLUMN sealed BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE routes   ADD COLUMN sealed BOOLEAN NOT NULL DEFAULT FALSE;