stack-encrypt: add shared record runtime conformance #1472

Declaration agreement alone does not establish the meaning of runtime writes, null handling, batches and query conversions. Add the record-runtime-v1 profile, executed against the same cases by native Rust and Go WASI.

Implementation: #1461.

Acceptance criteria:

• Specify missing versus explicit null, SQL-null omission and sealed-null storage, equality and ciphertext-length behavior.
• Cover typed batch round trips and source refusals, including failures late in a batch.
• Compare lengths only for stored ciphertexts, including mixed present/absent and entirely absent SQL-null cases.
• Cover lossless equality-query conversions and refuse unsupported or lossy inputs.
• Return and compare structured code/reason/field diagnostics for missing and unknown Go source fields, preserving ErrEncoding rather than freezing English messages.
• Validate the same corpus vocabulary in both runners and document single-fault refusal cases without imposing map iteration order.
• Observe native validation-before-key-I/O and batching counts, reusing existing helpers and retaining language-specific tests.

Malformed stored reads, broader kind/operator coverage and Python/TypeScript mappings are separate slices. This issue does not claim Go provider-call instrumentation or exhaustive runtime coverage.

Depends on #1471 (implemented by #1460).