Seal the service provider's resource — prove the pattern #626

Feature: #625 · Phase 1 of sealed-provider-resources.md.

Prove the pattern on the provider with the smallest external footprint — service, which zero files outside its own package name — and make the result the template every later provider follows. Surprises surface here, where they are cheap.

Land the full shape:

1. service.Resource becomes a sealed interface (unexported marker method, so implementations cannot be added from outside the package).
2. The struct becomes the unexported service.resource, implementing it.
3. The exported constructor keeps its signature and returns the unexported type — legal Go, and what the generator's detection rule (func(*op.RuntimeEnvironment, any) (*T, error)) already accommodates.
4. Verify the enabling fact for this provider specifically: its gen/*.gen.go declares the provider's own package, so the announcement can name the unexported type. Confirmed for the sample on 2026-08-23; confirm per provider rather than assuming.

Acceptance — serialization must not move. A graph planned before and after produces the same resources section for the same intent: the URI fragment names the concrete struct either way, and only its visibility changed. Round-trip pins stay byte-identical, and a saved document still reloads (the type id resolves through the registry to the exported constructor).