A group template can be marked `sealed = true` so the per-app suppression filters skip it — closing the advisory-by-default compliance footgun the suppression review flagged. Only meaningful on a group-owned template; existing rows default unsealed. Consumption gates land in M3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>