Encompute 0.2.0

Real private execution: a client encrypts, a separate evaluator computes,
only the client decrypts.

• Client/evaluator split. CkksClient and CkksEvaluator traits; the
  OpenFHE code is split into encompute-openfhe (evaluation only) and
  encompute-openfhe-client (keys, encryption, decryption). The evaluator
  binary links no client crypto; scripts/audit-evaluator-binary.sh checks
  it in CI.
• Envelopes. Every ciphertext, key set and result is wrapped in a
  versioned, SHA-256-checksummed envelope bound to parameter set, program and
  key. Wrong key, program, parameters or kind, and corruption, are rejected
  with ENC16xx codes.
• Evaluator service. encompute-evaluator serve (HTTP): program upload,
  one-time evaluation-key registration, jobs. --workers N runs worker
  processes with crash restart and replay (ADR-005). Container image:
  Dockerfile.evaluator.
• CLI. keys generate, serve, run --remote --keys, audit,
  explain --measure (measured bytes, time, memory, error, ranking).
• Hardening. Parameter conformance against OpenFHE (10 080-point grid,
  nightly) and encrypted execution of random programs; fuzzing of the
  parser, envelopes and artifacts; artifact format 2 with versioned
  compiler, plan and parameter-selector provenance.
• Demo. scripts/two-machine-demo.sh: 384-d encrypted query vs 64
  documents on a containerized evaluator, max error 1.9e-7, top-5 equal to
  plaintext, no secret key in the container. Runs in CI.
• Benchmarks. docs/benchmarks.md: five workloads and evaluator
  concurrency.

Breaking: artifact format 2 (recompile 0.1 artifacts); error codes renamed
VEIL#### → ENC####; project renamed Veil → Encompute.