refactor: rename sealed to no-new-exports

[abao-bot]

Summary

Renames the module descriptor key sealed to no-new-exports across the entire codebase. The previous term often confused AI agents, who would interpret it as locking the file body (similar to Rust/Java's sealed class); the new term makes the actual constraint explicit: the file's export surface is closed while the body remains editable.

This is a breaking change with no backward compatibility for the old key.

Changes

Descriptor schema

• YAML frontmatter key: sealed → no-new-exports

Domain types

• ModuleContract.sealed → noNewExports
• ModuleFrontmatter field updated to match the hyphenated YAML key

Gate code

• src/gates/sealed-gate.ts → no-new-exports-gate.ts
• checkSealed → checkNoNewExports
• SealedCheckResult → NoNewExportsCheckResult
• Denial message updated to reference no-new-exports

Skill

• skills/module-seal-all/ → skills/module-no-new-exports-all/
• Script and type definition renamed accordingly
• Manifest updated to new skill name

Fixtures and tests

• All fixtures, behavior tests, claude hook e2e tests, and unit tests updated

Documentation

• README terminology, examples, gate descriptions, and skill link updated
• System prompt template updated
• All tracked MODULE.md descriptors updated, including src/gates/MODULE.md visible list

Package

• Bumped to 0.22.0 for the breaking descriptor rename

Notes

Unrelated language-level uses of sealed (Kotlin sealed class, Scala sealed trait, Java sealed class, TypeScript @sealed decorator tests) are intentionally preserved.