feat(sealed): sealed visibility + ineffective-suppress warning (§11 tail M4)

- `pic triggers ls --group` / `routes ls --group` gain a `sealed` column
  (threaded through TriggerTemplateInfo/RouteTemplateInfo + the two DTOs).
- dangling_suppress_warnings now also warns when a suppress reference matches
  only SEALED inherited templates ("... is sealed — the suppression has no
  effect") via `bool_or(NOT sealed)` per handler/path — making the mandatory
  guarantee observable at plan/apply time, alongside the existing typo guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1405,6 +1405,9 @@ pub struct TriggerTemplateDto {
     #[serde(default)]
     pub script: String,
     pub enabled: bool,
+    /// §11 tail: `true` for a sealed (non-suppressible) template.
+    #[serde(default)]
+    pub sealed: bool,
 }
 
 /// One row of the §11 tail route-template report.
@@ -1423,6 +1426,9 @@ pub struct RouteTemplateDto {
     #[serde(default)]
     pub dispatch: String,
     pub enabled: bool,
+    /// §11 tail: `true` for a sealed (non-suppressible) template.
+    #[serde(default)]
+    pub sealed: bool,
 }
 
 /// One row of the §11.6 shared-collection report.

crates/picloud-cli/src/cmds/routes.rs

@@ -50,6 +50,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
         "script",
         "dispatch",
         "enabled",
+        "sealed",
     ]);
     for r in rows {
         table.row([
@@ -60,6 +61,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
             r.script,
             r.dispatch,
             r.enabled.to_string(),
+            r.sealed.to_string(),
         ]);
     }
     table.print(mode);

crates/picloud-cli/src/cmds/triggers.rs

@@ -47,9 +47,15 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
     let rows = client.group_triggers_list(group).await?;
-    let mut table = Table::new(["kind", "target", "script", "enabled"]);
+    let mut table = Table::new(["kind", "target", "script", "enabled", "sealed"]);
     for t in rows {
-        table.row([t.kind, t.target, t.script, t.enabled.to_string()]);
+        table.row([
+            t.kind,
+            t.target,
+            t.script,
+            t.enabled.to_string(),
+            t.sealed.to_string(),
+        ]);
     }
     table.print(mode);
     Ok(())