Function encode_envelope_to_vec 

pub fn encode_envelope_to_vec(
    payload: &[u8],
    hmac_key: &[u8; 32],
) -> Result<Vec<u8>, ArtifactError>

Encode payload into the unified artifact-store envelope (v0.4 snapshot default).

Returns Vec<u8> containing the byte sequence ARTIFACT_MAGIC || ARTIFACT_VERSION || blake3(payload) || zstd(payload) || hmac_sha256(prefix) — the same bytes DiskArtifactStore::put would write to its tempfile before atomic-rename. Useful for callers that need the framed envelope in memory (the snapshot crate’s default capture path is the motivating consumer).

The HMAC covers magic || version || content_hash || zstd(payload); the trailing 32-byte tag is appended after. Verification is the counterpart decode_envelope_from_bytes, which recomputes the MAC in constant time and rejects on mismatch before any decoded bytes are exposed to the caller.

Errors are reported via ArtifactError to keep the error surface homogeneous with the disk store; the only failure modes are TooLarge (when payload.len() > MAX_PAYLOAD_LEN) and Io (when the in-memory zstd encoder reports an internal error).