stack-encrypt conformance: add TypeScript runner and public SDK mapping tests #1479

Add a conformance consumer for the planned Stack Encrypt TypeScript bindings, using the same corpus and frozen fixtures.

Acceptance:

• Integrate with the binding delivered under @cipherstash/stack runs a second encryption engine (protect-ffi) — new major built on stack-encrypt (umbrella) #1065; establish its actual public API and backend instead of assuming Go's WASI model.
• Consume shared cases without duplicating expected semantics; declare supported profiles and capabilities explicitly.
• Test public SDK mappings for number/bigint ranges, undefined/null, bytes, timestamps and other supported values; reject lossy conversions.
• Enroll native and WASM variants if both are supported, with backend-specific lifecycle evidence.
• Join fresh exchange (stack-encrypt conformance: expand fresh cross-language artifact exchange #1478) and CI; missing required cases/backends cannot become successful skips.

Binding availability is a dependency. This is tracked in milestone 4 for visibility; whether TypeScript delivery blocks the Rust release must be settled explicitly in the release-gate issue.

Plan: conformance roadmap and API redesign #1365.