Function decrypt_envelope 

pub fn decrypt_envelope(
    root_key: &[u8; 32],
    blob: &[u8],
    aad: &[u8],
) -> Result<(Vec<u8>, Nonce<16>), CryptoError>

Decrypts a blob with envelope format (VD01 header required).

Returns (plaintext, nonce) used for key derivation. Errors if blob does not have VD01 envelope header.