stack-encrypt conformance: close value, refusal and raw-frame coverage gaps #1477

The enrolled scalar/value/query profiles are representative, not complete boundary matrices.

Acceptance:

• Inventory supported kinds and add missing integer boundaries, bytes, floats, decimal/time precision, null policies and source/read shape combinations.
• Extend shared operator rejection cases across capability and operand shapes, retaining structured diagnostics and validation-before-I/O observations.
• Reuse stack-encrypt: pin every query refusal across the typed chain and the binding in one table test #1317 for the typed/dynamic query-refusal baseline and track intentional fixes through stack-encrypt: a query's refusals are written separately for Rust callers and the Go binding, and have drifted once — give both one query preparation #1279 and its children.
• Add an explicit raw-frame path for repeated keys and malformed leaves that map-based encoders cannot represent.
• Distinguish malformed transport, invalid declarations, authenticated type failures and unsupported host conversions.
• Verify each required case runs in Rust and Go; document remaining unsupported combinations.

Build on #1471–#1474. Do not add lossy JSON-number representations or silently change frozen expectations.

Plan: conformance roadmap and API redesign #1365.