stack-encrypt: pin every query refusal across the typed chain and the binding in one table test #1317

Parent

#1279

What to build

Stack Encrypt refuses some queries before it derives a query term: bad match options, match text it cannot normalize, match text that cuts no token, equality text it cannot normalize, and a between whose low bound is above its high bound. A Rust caller meets these refusals through the typed query chain (cipher.query(op, value).on(&plan)). The Go SDK meets them through the binding (dynamic::check_query, dynamic::query_term, dynamic::verify).

This ticket adds one table test that runs every refusal through each path and records what each path does today. It changes no production code. It is the guard the rest of #1279 refactors under: if a later ticket makes one path refuse differently, this test fails.

Acceptance criteria

• One table-driven test, with one row per refusal: invalid match options (n-gram length of zero), unnormalizable match text, empty match text, unnormalizable equality text, and an inverted range at several integer widths (including a 128-bit width).
• Each row runs through the typed query chain, check_query, query_term, and verify where the operator is matches, and asserts the TermError / PlanError variant each one returns.
• Typed rows use the load-counting fake key source the integration tests already share, and assert whether a key was loaded before the refusal.
• The equality-normalization row records today's known gap: the binding refuses before any keyset, and the typed chain refuses only once it derives the term. A comment on the row points at stack-encrypt: a typed equality query on text that cannot be normalized is refused only after the keyset is resolved — refuse it first, as the Go binding does #1321, which flips it, so the change is made there on purpose and not silently.
• No live credentials are needed; the test runs in the normal cargo nextest job.
• Existing fixtures (query_operators.json, value_kinds.json) are untouched.

Blocked by

None (can start immediately).

Milestone coordination

Included in milestone 4 as the existing query-refusal baseline for #1477. Reuse its cases when enrolling shared negative requirements; keep intentional behavior fixes in #1279 and its child issues.