make "fail closed, no swallowed errors at a seam" executable instead of a review convention

[rubenhensen]

Question

Workstream E's policy line — "crypto paths fail closed; no error swallowed at a seam" — is recorded as "enforced in review". What makes it executable instead?

Every other contract in this programme became a gate: append-only fixtures, oasdiff, cargo-semver-checks, wire-compat, public-API snapshots. This one stayed a convention, and it guards the audit's second-largest bug class (~20 incidents) — including the worst single bug of the year: the Thunderbird addon silently sending plaintext when MV3 suspension wiped its state (postguard-tb-addon#67). It then regressed, because a unit test had pinned the buggy behaviour.

A review convention did not catch it the first time, and did not catch the regression. It is the last unenforced item in the fix strategy.

Candidates, to choose between rather than adopt wholesale

• Rust: a clippy lint set denied in CI over the crypto paths — unwrap_used, expect_used, and a deny on catch-all Err(_) => arms in pg-core's unsealer and pg-pkg's key derivation.
• JS: an eslint rule banning empty catch blocks and catch { return null }-shaped swallowing in the envelope and unseal paths.
• Per-seam typed-error test: assert each boundary surfaces a typed error rather than a falsy or empty value on malformed input. Closest to the actual failures, most work.
• A "no plaintext fallback" property test: any failure anywhere in the encrypt path must result in nothing being sent. Directly pins the tb#67 class, and would have failed on the regression.

Deliverable

A decision on the mechanism, and on whether it is one gate or one per language surface. Note that a lint-based answer needs the #272 treatment — dobby cannot push the workflow half.