stack-encrypt refactor: remove transitional traits and redundant execution APIs #1488

Background

Stack Encrypt (packages/stack-encrypt) is the Rust engine that every CipherStash language SDK runs on. It has two Rust APIs side by side on next:

• The new API. Owned conversions through EncryptTarget and DecryptSource, and paired entry points such as keyset.encrypt(..) and keyset.encrypt_with_context(..) (feat(stack-encrypt): add owned scalar ciphertext API #1404).
• The old API. EncryptFrom, DecryptInto, encrypt_as, the helpers in target::legacy, and the plan chain in plan/chain.rs, with its .context(..), .extend(..), and .keyset(..) steps.

The Stack Encrypt API plan, merged in pull request #1365, keeps the new API and removes the old one.

Problem

Two APIs for the same job make the right one hard to find. The chain also causes real defects. A context part added late in a chain can replace an earlier one (#1120). Rust then builds a different context from Go, and a query finds nothing.

Proposal

The plan items "One context argument, and paired entry points" and "Remove the structural API" describe the work.

1. Add Planned::new(&plan, value), with encrypt, encrypt_with_context, decrypt, and decrypt_with_context. It replaces the chain in plan/chain.rs and every chain state.
2. Pass context as one argument, built from Scope and Bind values. The type fixes the order: scopes, then bindings.
3. Choose the keyset first. It is the receiver of the scalar entry points, and the argument of every other verb, as in encrypt(&keyset). There is no using method.
4. Check a stored context part passed on decrypt against the row before any key is fetched. ExpectedContext does this today. It stops being a public type.
5. Replace the CipherScope trait and the dynamic::Scope enum with one borrowed value, CipherRef<'c, K>. Both reduce to a connection and an optional keyset ID. Build it with From<&Cipher> and From<&Keyset>. Entry points take impl Into<CipherRef>. A Keyset reference refuses a leaf from another keyset with ForeignKeyset. A Cipher reference opens leaves from any keyset the client can use.
6. Remove EncryptFrom, DecryptInto, encrypt_as, and target::legacy.
7. Remove the old context path type Label and IntoLabel. A plan's context is its declared Scope parts, and the guest sends parts, not a path.
8. Rename the plan builder's output method from build() to target.
9. Move EQL, the Go guest, and every example to the new API in the same change.

encrypt_tree and decrypt_tree stay, as explicit structural operations.

Acceptance

• The examples in the plan's Target state compile.
• tests/ui compile-fail cases cover a binding in a query, and a scope after a bind.
• plan/chain.rs is gone, and Planned runs every test the chain ran.
• No consumer uses a removed type: EQL, the guest, examples, and generic callers.
• Batching, lifecycle, and cross-language conformance checks pass. Stored data and released SDK contracts are unchanged.
• stack-encrypt: a second .extend() replaces the first, so Rust builds a different context than Go and a query silently misses #1120 is closed.

Do not add aliases only to keep the unpublished prototype names. Account for any contract a customer already depends on.

Relationship to other work

• Depends on stack-encrypt refactor: migrate record derives and plans to owned declarations #1483, stack-encrypt refactor: complete configured definitions and typed query APIs #1486, stack-encrypt refactor: add explicit owned whole-value blob encryption #1484, and stack-encrypt refactor: add typed encoded ciphertext targets and tag access #1485, as each applies.
• The renames in stack-encrypt refactor: finalize crate ownership, naming and coordinated migration #1489 change some of the names above, such as StackCipher to Cipher and KeysetCipher to Keyset.

Plans: the Stack Encrypt API plan and the conformance roadmap.