Load the 32-byte sync key from path, generating and persisting a fresh one
if absent. The file is written 0600 because the key grants full read of every
synced memory (safety: file perms must be 0600).
Open one wire line back into the plaintext JSONL record. A line that is not
valid base64 is treated as a legacy plaintext JSONL record and returned as-is
(with a one-time warning), so logs written before encryption still import.
Seal one plaintext JSONL record into a single base64 line safe for the
line-oriented SSH transport. base64 is required because the AEAD frame is
binary and the wire is newline-delimited text.