stack-encrypt refactor: separate ciphertext binding from search scope #1487

The agreed role separation must let ciphertext bind to a row while searchable terms use a broader declared scope.

Acceptance:

• Specify exact role composition and encoding, e.g. ciphertext bound to column/tenant/row and equality scoped to column/tenant.
• Implement explicit scope/binding eligibility and required-input rules in Rust and the dynamic definition grammar; queries use the same declared search scope as writes.
• Validate nominal typed handles where available, and physical shape/range/required values for dynamic requests before lowering or key I/O.
• Preserve distinct resolved roles through AAD and index-key/KMS descriptor derivation; do not merely drop a component from one generic context.
• Update Go authoring/generated interfaces and add cross-language positive/refusal/tamper cases.
• Record versioning and release implications before changing any released storage/search contract.

Depends on the current-semantics baseline #1475; coordinate definitions with #1486 and record migration with #1483. Optional provider routing, audit/lock context and tag-refinement protocols are separate work, not silently included here.

Plan: conformance roadmap and API redesign #1365.