stack-encrypt conformance: expand fresh cross-language artifact exchange #1478

Background

Stack Encrypt (packages/stack-encrypt) is the Rust engine that every CipherStash language SDK runs on. The Rust crate and the Go SDK must write and read the same bytes. The Go SDK runs the same engine as a WASI guest, compiled to WebAssembly. Python and TypeScript SDKs are coming.

The conformance corpus in conformance/stack-encrypt/ is a shared set of test cases that every language runs. It makes all SDKs agree on what each declaration and operation means.

Artifact exchange means one language seals fresh values and another language opens them. Today fresh exchange covers scalars from Go to Rust. Wider fixtures are mostly frozen rows that Rust wrote and Go reads.

Problem

Frozen rows prove that today's code reads old data. Only fresh exchange in both directions proves that today's Rust and today's Go agree.

Proposal

• Exchange freshly written wider values, records, blobs, and EQL and JSON artifacts as each profile becomes available.
• Run both directions: Rust writes and Go reads, and Go writes and Rust reads. Add Python and TypeScript, and their backends, when their runners exist.
• Record these in each artifact and report: the producer SDK, engine, backend, profile, capabilities, storage version, and SQL version.
• Compare decrypted values and query results. Ciphertexts are random, so never compare them for equality.
• Require fresh, non-empty output, and skip the producer's test caches. A missing runner or guest fails a required lane.
• Add supported combinations of released versions once the compatibility policy in Docs: EQL v4 and Stack Encrypt compatibility policy #1314 exists.
• Exchange EQL scalar payloads in both versions. Version 1 is what rc.3 writes. Version 2 adds the key header h beside a Base85 c (stack-encrypt refactor: add typed encoded ciphertext targets and tag access #1485).
• When the key request item envelope lands, exchange both envelope versions. It uses the format byte 0x02.

Depends on the enrolled profiles in #1471 to #1474 and #1476. Python is tracked in #1393. Do not claim a language pair until both implementations exist. Issue #1512 adds the same exchange through PostgreSQL.

Pull request #1506 does this work.

Plans: the Stack Encrypt API plan and the conformance roadmap.