feat(sealed): sealed visibility + ineffective-suppress warning (§11 tail M4)

- `pic triggers ls --group` / `routes ls --group` gain a `sealed` column
  (threaded through TriggerTemplateInfo/RouteTemplateInfo + the two DTOs).
- dangling_suppress_warnings now also warns when a suppress reference matches
  only SEALED inherited templates ("... is sealed — the suppression has no
  effect") via `bool_or(NOT sealed)` per handler/path — making the mandatory
  guarantee observable at plan/apply time, alongside the existing typo guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1405,6 +1405,9 @@ pub struct TriggerTemplateDto {
     #[serde(default)]
     pub script: String,
     pub enabled: bool,
+    /// §11 tail: `true` for a sealed (non-suppressible) template.
+    #[serde(default)]
+    pub sealed: bool,
 }
 
 /// One row of the §11 tail route-template report.
@@ -1423,6 +1426,9 @@ pub struct RouteTemplateDto {
     #[serde(default)]
     pub dispatch: String,
     pub enabled: bool,
+    /// §11 tail: `true` for a sealed (non-suppressible) template.
+    #[serde(default)]
+    pub sealed: bool,
 }
 
 /// One row of the §11.6 shared-collection report.