feat(suppress): consume per-app suppressions at trigger + route dispatch (§11 tail S3)

The runtime half — suppressions now actually decline inherited templates.

- Triggers (live, per-event): a correlated NOT EXISTS anti-join
  (TRIGGER_SUPPRESSION_ANTIJOIN) appended to all four dispatch match
  queries (list_matching_kv/docs/files + the pubsub fan-out). It excludes a
  group-owned trigger whose handler script name the firing app suppresses;
  `$1` is the firing app (already bound), and the `t.group_id IS NOT NULL`
  guard keeps an app's OWN trigger unsuppressable.
- Routes (rebuild-time): compile_effective_routes takes a
  `suppressed_paths: &HashSet<(AppId, path)>` and drops an inherited
  (`depth > 0`) route at a suppressed path — the binding 404s.
  rebuild_route_table loads the set via a new
  RouteRepository::list_route_suppressions, so every existing rebuild edge
  (route CRUD, apply, tree mutations) already applies it. No new
  invalidation edges; the marker CASCADEs on app delete.

Pinned by tests/template_suppression.rs (live DB): a suppressing app
matches NEITHER the inherited trigger NOR route; a sibling that did not
suppress still inherits both; the app's OWN trigger on the suppressed
handler still fires (suppression is inheritance-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/trigger_repo.rs

@@ -17,6 +17,19 @@ use uuid::Uuid;
 use crate::config_resolver::CHAIN_LEVELS_CTE;
 use crate::trigger_config::BackoffShape;
 
+/// §11 tail per-app opt-out: exclude an INHERITED (group-owned) trigger whose
+/// handler script name the firing app suppresses. Appended to each dispatch
+/// match query's WHERE clause; `$1` is the firing app_id (already bound by the
+/// `CHAIN_LEVELS_CTE`). The `t.group_id IS NOT NULL` guard keeps an app's OWN
+/// trigger unsuppressable (an app can only decline what it inherits).
+pub(crate) const TRIGGER_SUPPRESSION_ANTIJOIN: &str = " \
+    AND NOT EXISTS ( \
+        SELECT 1 FROM template_suppressions ts \
+        JOIN scripts s ON s.id = t.script_id \
+        WHERE ts.app_id = $1 AND ts.target_kind = 'trigger' \
+          AND LOWER(ts.reference) = LOWER(s.name) \
+          AND t.group_id IS NOT NULL)";
+
 #[derive(Debug, thiserror::Error)]
 pub enum TriggerRepoError {
     #[error("database error: {0}")]
@@ -1318,7 +1331,7 @@ impl TriggerRepo for PostgresTriggerRepo {
              FROM triggers t \
              JOIN kv_trigger_details d ON d.trigger_id = t.id \
              JOIN chain c ON (t.app_id = c.app_owner OR t.group_id = c.group_owner) \
-             WHERE t.kind = 'kv' AND t.enabled = TRUE"
+             WHERE t.kind = 'kv' AND t.enabled = TRUE{TRIGGER_SUPPRESSION_ANTIJOIN}"
         ))
         .bind(app_id.into_inner())
         .fetch_all(&self.pool)
@@ -1368,7 +1381,7 @@ impl TriggerRepo for PostgresTriggerRepo {
              FROM triggers t \
              JOIN docs_trigger_details d ON d.trigger_id = t.id \
              JOIN chain c ON (t.app_id = c.app_owner OR t.group_id = c.group_owner) \
-             WHERE t.kind = 'docs' AND t.enabled = TRUE"
+             WHERE t.kind = 'docs' AND t.enabled = TRUE{TRIGGER_SUPPRESSION_ANTIJOIN}"
         ))
         .bind(app_id.into_inner())
         .fetch_all(&self.pool)
@@ -1415,7 +1428,7 @@ impl TriggerRepo for PostgresTriggerRepo {
              FROM triggers t \
              JOIN files_trigger_details d ON d.trigger_id = t.id \
              JOIN chain c ON (t.app_id = c.app_owner OR t.group_id = c.group_owner) \
-             WHERE t.kind = 'files' AND t.enabled = TRUE"
+             WHERE t.kind = 'files' AND t.enabled = TRUE{TRIGGER_SUPPRESSION_ANTIJOIN}"
         ))
         .bind(app_id.into_inner())
         .fetch_all(&self.pool)