stack-encrypt: add an owned scalar ciphertext API #1470

The direct Rust API requires structural ciphertext and explicit context plumbing even for a single scalar. Implement the first owned-scalar slice of the API redesign in #1365, through the existing batched engine.

Implementation: #1404. This issue records the scope of that PR, which is awaiting merge.

Acceptance criteria:

• Supported owned scalars encrypt into opaque Ciphertext and decrypt through the cipher-directed and destination-directed APIs.
• Context capabilities determine method availability; optional scalar context and required EQL context remain explicit and authenticated.
• Owned plaintext is protected during synchronous planning and its owner is wiped on success, error and context-conversion unwinding; returned plaintext remains caller-owned.
• Preserve the SealedValue v1 envelope, canonical byte/Serde representations and scalar/tree cross-opening.
• Name structural methods encrypt_tree / decrypt_tree, document the retained legacy derive helpers, and cover the API with examples, compile-fail, interoperability and cleanup tests.

Collections, borrowed plaintext, Option<T> and the deferred u8 specialization are outside this slice. Secure Buffer adoption remains the separate follow-up #1468; this PR must not close it.