feat(sealed): sealed visibility + ineffective-suppress warning (§11 tail M4)

- `pic triggers ls --group` / `routes ls --group` gain a `sealed` column
  (threaded through TriggerTemplateInfo/RouteTemplateInfo + the two DTOs).
- dangling_suppress_warnings now also warns when a suppress reference matches
  only SEALED inherited templates ("... is sealed — the suppression has no
  effect") via `bool_or(NOT sealed)` per handler/path — making the mandatory
  guarantee observable at plan/apply time, alongside the existing typo guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/routes.rs

@@ -50,6 +50,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
         "script",
         "dispatch",
         "enabled",
+        "sealed",
     ]);
     for r in rows {
         table.row([
@@ -60,6 +61,7 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
             r.script,
             r.dispatch,
             r.enabled.to_string(),
+            r.sealed.to_string(),
         ]);
     }
     table.print(mode);

crates/picloud-cli/src/cmds/triggers.rs

@@ -47,9 +47,15 @@ pub async fn ls_group(group: &str, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
     let rows = client.group_triggers_list(group).await?;
-    let mut table = Table::new(["kind", "target", "script", "enabled"]);
+    let mut table = Table::new(["kind", "target", "script", "enabled", "sealed"]);
     for t in rows {
-        table.row([t.kind, t.target, t.script, t.enabled.to_string()]);
+        table.row([
+            t.kind,
+            t.target,
+            t.script,
+            t.enabled.to_string(),
+            t.sealed.to_string(),
+        ]);
     }
     table.print(mode);
     Ok(())