Streams a walked directory tree as an encrypted archive into a fresh
output file. Memory stays bounded by the chunk size regardless of tree
size. A partially written output is removed on failure.
Streams the input file through the sealer into a fresh output file:
header first, then one encrypted chunk at a time, with memory bounded by
the chunk size. A partially written output is removed on failure.
Recursively walks a directory in sorted order, listing directories before
their contents. Entries that cannot be archived (symlinks, special
files, non-UTF-8 or backslash-containing names) are skipped; the count
of skipped entries is returned alongside.