feat: add protected storage workspace bridge

[kauandotnet]

Summary

• add an optional @nestm/crypto/storage-workspace entry point over capability-scoped @nestm/storage workspaces
• authenticate encrypted file metadata and bodies against workspace scope, policy revision, canonical path, record, version, and purpose
• preserve package boundaries: crypto core stays storage-free and storage stays crypto-free
• keep provider-visible path search explicit and application-owned
• add strict replay, tamper, limits, abort, rotation, package, and packed-consumer coverage

Verification

• pnpm run verify
• 212 unit tests
• 10 NMF1 vectors
• publint and ESM package checks
• packed core-only and storage-workspace consumers