feat(sealed): author + persist sealed group templates (§11 tail M2)

Thread `sealed` from the manifest through to the DB column:
- manifest: `sealed` on ManifestRoute + the four event-kind trigger specs
  (Kv/Docs/Files/Pubsub), flowing to Bundle via serde.
- persist: NewRoute.sealed + insert_route_tx; insert_trigger_tx `sealed`
  param; the reconcile passes br.sealed / bt.sealed().
- validate_bundle_for rejects `sealed` on an app owner (meaningless — an
  app route/trigger is never inherited).
- diff: `sealed` joins the route Update comparison and the trigger identity
  (both bundle + current sides), so toggling it re-applies rather than NoOp.

`sealed` lives on shared Route + manager-core Trigger (both pure DTOs) so
the diff can see the current value; RouteRow/TriggerRow default it so
RETURNING clauses that omit it still hydrate. No runtime read effect yet —
the two suppression gates land in M3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/init.rs

@@ -136,6 +136,7 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest {
             path: "/hello".into(),
             dispatch_mode: DispatchMode::Sync,
             enabled: true,
+            sealed: false,
         }],
         triggers: crate::manifest::ManifestTriggers::default(),
         secrets: crate::manifest::ManifestSecrets::default(),

crates/picloud-cli/src/cmds/pull.rs

@@ -94,6 +94,9 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                 path: r.path,
                 dispatch_mode: r.dispatch_mode,
                 enabled: r.enabled,
+                // `pull` reconciles an app; app-owned routes are never sealed
+                // (sealing is a group-template property, §11 tail).
+                sealed: false,
             });
         }
     }
@@ -158,6 +161,8 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     ops: d.ops,
                     dispatch_mode,
                     retry_max_attempts,
+                    // app-owned triggers are never sealed (group-template only).
+                    sealed: false,
                 });
             }
             "docs" => {
@@ -168,6 +173,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     ops: d.ops,
                     dispatch_mode,
                     retry_max_attempts,
+                    sealed: false,
                 });
             }
             "files" => {
@@ -178,6 +184,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     ops: d.ops,
                     dispatch_mode,
                     retry_max_attempts,
+                    sealed: false,
                 });
             }
             "cron" => {
@@ -197,6 +204,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
                     topic_pattern: d.topic_pattern,
                     dispatch_mode,
                     retry_max_attempts,
+                    sealed: false,
                 });
             }
             "queue" => {