feat(sealed): author + persist sealed group templates (§11 tail M2)

Thread `sealed` from the manifest through to the DB column:
- manifest: `sealed` on ManifestRoute + the four event-kind trigger specs
  (Kv/Docs/Files/Pubsub), flowing to Bundle via serde.
- persist: NewRoute.sealed + insert_route_tx; insert_trigger_tx `sealed`
  param; the reconcile passes br.sealed / bt.sealed().
- validate_bundle_for rejects `sealed` on an app owner (meaningless — an
  app route/trigger is never inherited).
- diff: `sealed` joins the route Update comparison and the trigger identity
  (both bundle + current sides), so toggling it re-applies rather than NoOp.

`sealed` lives on shared Route + manager-core Trigger (both pure DTOs) so
the diff can see the current value; RouteRow/TriggerRow default it so
RETURNING clauses that omit it still hydrate. No runtime read effect yet —
the two suppression gates land in M3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/triggers_api.rs

@@ -908,6 +908,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::Kv,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,
@@ -938,6 +939,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::Docs,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,
@@ -968,6 +970,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::DeadLetter,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: TriggerDispatchMode::Async,
                 retry_max_attempts: 1,
                 retry_backoff: BackoffShape::Constant,
@@ -999,6 +1002,7 @@ mod tests {
                 name: "mock".into(),
                 kind: TriggerKind::Email,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: TriggerDispatchMode::Async,
                 retry_max_attempts: 3,
                 retry_backoff: BackoffShape::Exponential,
@@ -1045,6 +1049,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::Cron,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,
@@ -1076,6 +1081,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::Files,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,
@@ -1106,6 +1112,7 @@ mod tests {
                 name: "mock".into(),
                 kind: crate::trigger_repo::TriggerKind::Pubsub,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,
@@ -1184,6 +1191,7 @@ mod tests {
                 name: "mock".into(),
                 kind: TriggerKind::Queue,
                 enabled: true,
+                sealed: false,
                 dispatch_mode: req.dispatch_mode,
                 retry_max_attempts: req.retry_max_attempts,
                 retry_backoff: req.retry_backoff,