stack-encrypt conformance: define lifecycle, cleanup and key-I/O requirements #1480

Shared semantic vectors do not prove binding cleanup, cancellation, ownership, diagnostics or batching behavior.

Acceptance:

• Map existing native and Go tests to named requirements for success/error/cancellation/drop paths, partial decode, buffer cleanup and secret-free diagnostics.
• Instrument providers to observe validation-before-I/O and logical batching; distinguish logical calls from physical provider chunk limits.
• Retain backend-specific tests and add Python/TypeScript evidence as each backend becomes available.
• Document ownership transfer and actual erasure limits; do not promise erasure of caller-owned host-language values.
• Require executable evidence for every claimed guarantee and explicitly identify unsupported/unobserved behavior.

Reuse #1468 for secure Buffer/protected-borrow adoption and #1458 for key storage/copy removal; those are implementation tasks, not duplicates of this coverage inventory. Python concurrency is #1394 and Python parity/extension hygiene is #1393.

Plan: conformance roadmap and API redesign #1365.