stack-encrypt conformance: close value, refusal and raw-frame coverage gaps #1477

Background

Stack Encrypt (packages/stack-encrypt) is the Rust engine that every CipherStash language SDK runs on. The Rust crate and the Go SDK must write and read the same bytes. The Go SDK runs the same engine as a WASI guest, compiled to WebAssembly. Python and TypeScript SDKs are coming.

The conformance corpus in conformance/stack-encrypt/ is a shared set of test cases that every language runs. It makes all SDKs agree on what each declaration and operation means.

The enrolled cases are a representative sample. They are not yet a full matrix of edge cases and refusals.

Problem

Missing edge cases let the Rust and Go implementations disagree without any test failing.

Proposal

• List every supported value kind. Add the missing cases: integer limits, bytes, floats, decimal precision, time precision, null handling, and every pairing of source shape with read shape.
• Add shared cases for refused operators, across each index capability and operand shape. Keep the structured error, and check that validation happens before any key is fetched.
• Start from stack-encrypt: pin every query refusal across the typed chain and the binding in one table test #1317, the table of query refusals for the typed API and the binding. Make intended behaviour changes in stack-encrypt: a query's refusals are written separately for Rust callers and the Go binding, and have drifted once — give both one query preparation #1279 and its child issues.
• Add a raw-frame path for cases a map-based encoder cannot write, such as repeated keys and malformed leaves.
• Keep four errors separate: malformed transport, an invalid declaration, a failed authenticated type check, and an unsupported host conversion.
• Check that each required case runs in Rust and in Go. Document the combinations that are still unsupported.

Follows #1471 to #1474. Do not add lossy JSON number forms. Do not change frozen expectations without saying so.

Pull request #1505 does this work.

Plans: the Stack Encrypt API plan and the conformance roadmap.