Identifies the safe-migrate encryption envelope without attempting to
decrypt it. This supports safe metadata inspection without exposing key
material or payload contents.
Encrypts an encoded cache when cache encryption is enabled. The on-disk
envelope includes only a format marker and random nonce; the authenticated
ciphertext contains all cache metadata.
Returns plaintext encoded cache bytes. Encrypted files require both an
enabled configuration and the environment-only key; authentication failures
intentionally do not distinguish a wrong key from modified ciphertext.