Function should_seal_component 

pub fn should_seal_component(id: &str) -> bool

Should this component be sealed on install (core OR install-once)?

A sealed component is reused (not reinstalled) on subsequent installs and protected from force-reinstall unless MLSTACK_UNSEAL_CORE=1 — the tenet’s “once installed, NEVER overridden” guarantee.