Unsealed-passport count and sweep ignore terminal statuses

[LKSNDRTMLKV]

Both the repair sweep and the operator-wide summary answer "which published
passports carry no seal" with the same three conditions, and neither looks at
status:

WHERE p.published_at IS NOT NULL
  AND p.doc->'seal' IS NULL
  AND p.doc->>'jwsSignature' IS NOT NULL

SealOutbox::enqueue_unsealed (crates/dpp-dal/src/pg/repo_seal.rs) adds two
NOT EXISTS guards on top for rows the drain already owns, but no status
filter; SealOutbox::unsealed_published_count uses the three conditions alone.
Sharing the predicate is deliberate — two definitions of "unsealed" would drift
— so a decision here should move both together.

published_at IS NOT NULL never becomes false again. A passport that was
published, went unsealed, and has since moved to Archived, Deactivated or
Superseded therefore still matches.

The two halves pull in opposite directions

The count is arguably right as-is. The passport was published without a
seal. The obligation attached at publish and is not discharged by the document
later reaching end of life, so reporting it is the honest answer to "is anything
unsealed".

The sweep is more doubtful. It will buy a qualified seal — a paid
third-party call — for a document that is archived or superseded. What that
attests to is a signature on a passport nobody will resolve again.

What an operator sees today

unsealedPublished: 3 with no way to tell whether those three are live products
or three archived records from last year. The number that is supposed to prompt
action cannot distinguish the case that needs action from the case that does
not.

Options, none obviously correct

1. Split the count — report live and terminal separately
   (unsealedPublished / unsealedTerminal), leave the sweep alone. Honest
   about both, costs a field.
2. Filter the sweep only — stop buying seals for terminal passports, keep
   counting them. Breaks the shared predicate, which is the thing that keeps the
   two from drifting; would need the split expressed some other way.
3. Filter both — treat terminal passports as out of scope entirely. Simplest,
   and silently drops the record that an obligation went unmet.

The choice depends on whether an unsealed archived passport is a compliance fact
worth surfacing or noise, and that is a regulatory reading rather than an
engineering one.

Not urgent

Pre-existing in the sweep since it landed; the summary route did not introduce
it, only made it visible. Nothing is wrong today at zero unsealed passports —
this is about what the number means once it is non-zero.