Make @cipherstash/stack v3-only for authoring and wire emission while preserving v2 decrypt

[tobyhede]

Part of #778 and the EQL v2 removal.

The native entry still emits v2 for an all-v2 or loose schema set because resolveEqlVersion returns undefined and protect-ffi treats it as v2. The WASM entry already rejects v2, so the entries disagree.

Acceptance criteria:

• Establish a v2 decrypt fixture and cross-generation tests that do not mint data through the public v2 emission API being removed.
• Remove the v2 schema builders and root exports.
• Reject every production v2 authoring or emission route, including config.eqlVersion: 2 and loose BuildableTable inputs.
• Preserve decryption of existing v2 payloads in the native core and DynamoDB read path.
• Make Encryption static types agree with runtime for v3 schemas, non-tuple schema arrays, and config typing; add a declaration test against built dist.
• Make typed-client re-initialization schema-safe: either reject a re-init whose encrypt config differs from the schema tuple captured by the typed client, or rebuild every schema-derived reconstructor and unknown-table guard. Cover the round trip so a newly configured table cannot encrypt successfully and then fail decrypt against stale maps.
• Include public API, skill, README, and changeset updates.

This is one core-contract change, not a sequence of PR-number-labelled issues.