feat(sealed): sealed column on triggers + routes (§11 tail M1)

A group template can be marked `sealed = true` so the per-app suppression
filters skip it — closing the advisory-by-default compliance footgun the
suppression review flagged. Only meaningful on a group-owned template;
existing rows default unsealed. Consumption gates land in M3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/expected_schema.txt

@@ -342,6 +342,7 @@ table: routes
   dispatch_mode: text NOT NULL default='sync'::text
   enabled: boolean NOT NULL default=true
   group_id: uuid NULL
+  sealed: boolean NOT NULL default=false
 
 table: script_imports
   app_id: uuid NOT NULL
@@ -406,6 +407,7 @@ table: triggers
   updated_at: timestamp with time zone NOT NULL default=now()
   name: text NOT NULL default=(gen_random_uuid())::text
   group_id: uuid NULL
+  sealed: boolean NOT NULL default=false
 
 table: vars
   id: uuid NOT NULL default=gen_random_uuid()
@@ -931,3 +933,4 @@ constraints on vars:
   0056: group triggers
   0057: group routes
   0058: template suppressions
+  0059: sealed templates