feat: add encrypted artifact storage protocol

[kauandotnet]

Summary

• add framework-neutral CAE1 artifact and namespaced object-store facades
• add local and AWS KMS key providers, bounded DEK cache, legacy compatibility vectors, and Nest composition
• preserve deployed filesystem and object-provider layouts while isolating object namespaces
• harden envelope validation, bundle extraction, filesystem sidecars, sweepers, and fail-closed reads
• export @nestm/storage/artifacts and @nestm/storage/artifacts/nest

Verification

• pnpm check
• pnpm test (211 unit; 22 e2e passed, 1 skipped)
• pnpm verify:pack
• independent adversarial compatibility/security review