refactor: keep crypto storage-neutral

[kauandotnet]

Summary

• remove the storage-specific crypto subpath and optional storage peer
• keep application storage policy and record composition outside the generic crypto package
• retain the generic core cipher and key-provider APIs
• add a prerelease changeset for the boundary correction

Verification

• pnpm verify
• 199 unit tests
• package build, publint, arethetypeswrong, and packed-consumer checks
• confirmed the packed package has no storage-workspace export or storage dependency

Follow-up

After this merges, the Changesets release PR will publish alpha.7. Workspace Runtime will then repin its validation app and land the API-owned composition.