stack-encrypt refactor: add typed encoded ciphertext targets and tag access #1485

The scalar slice has canonical bytes and key_tag, but the accepted API also needs typed text conversions and explicit encoded ciphertext field targets.

Acceptance:

• Return validated encoding wrappers for Base64/Base85 conversion and accept them through fallible ciphertext envelope parsing.
• Implement ciphertext-specific encoded targets through EncryptTarget/DecryptSource; do not make arbitrary text wrappers encryption targets.
• Seal once, encode completed output, and preserve batching without extra KMS calls.
• Keep encoding validity, envelope validity and authenticated decryption distinct.
• Specify checked key-tag/header access and matching SQL extraction where supported; test malformed lengths, truncation and versions.
• Add Rust/Go/SQL fixtures and mixed-record examples while retaining prescribed EQL representations.

Build on #1470 and coordinate mixed records with #1483. Reuse shared encoding types without introducing a Stack-to-EQL dependency cycle. Final wrapper names/component placement remain design details; refined-tag protocol implementation is not included.

Plan: conformance roadmap and API redesign #1365.