feat(sealed): sealed journey + docs (§11 tail M5)

- tests/sealed.rs: a group declares a sealed [[routes]] template; a descendant
  that suppresses it still serves the path, apply warns "sealed — no effect",
  routes ls --group shows sealed=true, and sealing an [app] route is rejected.
- docs: §4.5 trust-model callout + CLAUDE.md move `sealed` from Deferred to
  implemented — group templates are advisory-by-default *unless* sealed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/cli.rs

@@ -41,6 +41,7 @@ mod pull;
 mod roles;
 mod routes;
 mod scripts;
+mod sealed;
 mod secrets;
 mod staleness;
 mod suppress;