Created + open + mounted handle to an encrypted volume. The
mount_path is what the Docker backend bind-mounts at
data_path inside the container. Drop semantics: do NOT do
anything on drop — destruction is explicit via
destroy_encrypted_volume, which the docker backend calls from
delete_container. (Doing it on drop would risk
double-destruction on retry paths.)
Verify cryptsetup is on PATH. Provider should call this at
startup if any template it serves has data_path: Some(_) and
the operator has not opted out of consumer-encrypted volumes.
Returns the version string so the operator can log what they
got.