stack-encrypt refactor: add explicit owned whole-value blob encryption #1484

The scalar API intentionally excludes arbitrary composites. Add explicit OpaqueBlob support rather than a blanket Serialize fallback.

Acceptance:

• Select and document the library-owned codec, authenticated discriminator/version, supported types, schema evolution and decode errors.
• Encode a complete composite as one opaque Ciphertext, distinct from collection batching and structural-tree persistence.
• Authenticate before decoding; guard source values, growing encoder buffers, decoded intermediates and partial failures.
• Document actual timing/length-disclosure guarantees; arbitrary Serde support must not imply constant-time serialization.
• Persist/reload through a fresh cipher and add fixed vectors, malformed-input tests and exchange evidence.
• Specify ordinary owned results and any opt-in drop-guarded result adapter without implying Zeroize alone wipes on drop.

Build on #1470; coordinate secure-buffer adoption with #1468 and lifecycle evidence with #1480. Reuse Vitamin C storage/codec contracts and existing Go opaque behavior rather than inventing a second wire format.

Plan: conformance roadmap and API redesign #1365.