Finish adapter correctness and release verification for the v2 removal

[tobyhede]

Part of #778 and the EQL v2 removal. This combines independent adapter correctness fixes with the release gates that prove the removed surface has no surviving consumer.

Acceptance criteria:

• Preserve nested PostgREST OR structure and referencedTable for encrypted string and structured or filters; no plaintext operand may reach the wire. Reject or deliberately handle nullish matches() operands instead of degrading them to plaintext filters.
• Define safe behavior for non-row result modes such as .csv() so CSV text is never passed to bulkDecryptModels.
• Honor SQL LIKE escaping when adapting encrypted like / ilike calls: escaped % and _ are literals, not wildcard controls.
• Detect the removed legacy encryptedSupabase({ encryptionClient, supabaseClient }) call shape (or otherwise validate the supplied client) and fail with an actionable migration error before the first query.
• Align native, WASM, and Supabase Date reconstruction, including invalid values, nested paths, aliases, and bulk behavior. Relates to decrypt / bulkDecrypt hand back date columns as ISO strings while the model helpers return Date — silently, and not for the stated reason #779; do not widen decrypt or bulkDecrypt plaintext input types here.
• Typecheck examples, e2e consumers, and stack-drizzle integration sources in CI. The e2e package must declare the repository-pinned TypeScript dependency rather than resolving an ambient/global tsc.
• Correct the stash init Supabase handoff to name the concrete public.eql_v3_* domain family (with a valid example), and update its unit test and changeset together; eql_v3_encrypted does not exist.
• Reconcile pending changesets, skills, READMEs, and the feat!: remove EQL v2 repo-wide (umbrella, #707) #772/EQL v2 removal: review remediation for #772 #778 tracking text after the removal work lands. Do not rewrite already-published historical changesets. The audit must specifically ensure:
  • migration guidance names only the final 1.0 imports and symbols (no removed /v3 subpaths or *V3 adapter names, and no superseded Supabase behavior);
  • adapter behavior changes target the final owning adapter package in changeset frontmatter, not @cipherstash/stack by default;
  • the DynamoDB entry reflects decrypt audit support on the typed Encryption client; and
  • @cipherstash/nextjs receives only package-specific release notes, not the unrelated deleted-package narrative.
• Make CLI and wizard integration skill selection share one source of truth, or add a parity test that covers every integration and verifies SKILL.md availability, including Prisma Next.

The adapter fixes may be separate commits, but share one release-readiness outcome and final verification pass.