fix(triggers): SELECT group_id in TriggerRepo::get for template fidelity (§11 tail review)

`get` can fetch any trigger by id, including a group-owned TEMPLATE. It
omitted `group_id` and leaned on `#[sqlx(default)]`, so a template would
hydrate with both owners None — silently breaking the exactly-one-owner
invariant in memory. No caller hits this today (interactive trigger
management is app-scoped; prune deletes by id), but the fetch now
round-trips the owner faithfully and stays honest for future callers.
`list_for_app` is left as-is: its rows are all app-owned, so group_id is
legitimately NULL there.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/trigger_repo.rs

@@ -1271,8 +1271,12 @@ impl TriggerRepo for PostgresTriggerRepo {
     }
 
     async fn get(&self, id: TriggerId) -> Result<Option<Trigger>, TriggerRepoError> {
+        // §11 tail: `get` can fetch ANY trigger by id, including a group-owned
+        // TEMPLATE, so it must SELECT `group_id` (unlike `list_for_app`, whose
+        // rows are all app-owned) — else a template would hydrate with both
+        // owners None, breaking the exactly-one invariant in memory.
         let parent: Option<TriggerRow> = sqlx::query_as(
-            "SELECT id, app_id, script_id, name, kind, enabled, dispatch_mode, \
+            "SELECT id, app_id, group_id, script_id, name, kind, enabled, dispatch_mode, \
                     retry_max_attempts, retry_backoff, retry_base_ms, \
                     registered_by_principal, created_at, updated_at \
              FROM triggers WHERE id = $1",