void-crypto: Cryptographic primitives and key management for void.

This crate is the sole custodian of repository encryption key material. It provides:

• AES-256-GCM authenticated encryption with AAD
• HKDF-SHA256 key derivation with purpose separation
• Per-commit envelope encryption (VD01 format)
• KeyVault: an opaque vault that holds the root key and provides operations
• CommitReader: a per-commit handle for decrypting metadata and shards
• Scoped access tokens for limited read access

Security Architecture

The root key never leaves this crate. External crates interact with key material only through:

• KeyVault methods (open_commit, seal_commit, derived key accessors)
• CommitReader methods (decrypt_metadata, decrypt_shard)
• SecretKey references (derived keys for index/stash/staged)

Raw [u8; 32] key parameters are pub(crate) only — the crate boundary is the enforcement mechanism.