stack-encrypt refactor: migrate record derives and plans to owned declarations #1483

Records, derives, plans and dynamic targets still use EncryptFrom/DecryptInto while the scalar surface uses EncryptTarget/DecryptSource.

Acceptance:

• Define the complete signature/import/ownership map and migrate derives to the accepted declaration trait names.
• Support nested configured/unconfigured targets, explicit passthrough, source-field mapping and decrypt reconstruction.
• Enforce required/optional/omitted caller context through capabilities, with field-specific compile-time diagnostics.
• Preserve owned plaintext cleanup, intentional passthrough ownership transfer, and collection batching.
• Update plan lowering, dynamic/guest consumers and EQL adapters coherently against the same engine.
• Make mixed-record/searchable-record and batch examples executable and prove typed/dynamic/generated equivalence.

Depends on #1482 and #1475. Preserve already-implemented behavior while migrating it; legacy removal follows only after all consumers have equivalents.

Plan: conformance roadmap and API redesign #1365.