[web][web-shared][core] Make encrypted markers clickable and detect encryption before span selection

[karthikscale3]

Summary

• Early encryption detection: Added a lightweight probe that fetches a single event with full data after initial load to detect whether a run contains encrypted fields. This surfaces the Decrypt button in both the trace and events tabs before the user selects any span.
• Clickable encrypted markers: Encrypted placeholders in JSON inspector views and attribute panels are now clickable buttons labeled "Decrypt" that trigger the decryption flow directly, rather than requiring the user to find and click the top-level Decrypt button.
• hasEncryptedFields utility: New exported function in web-shared that checks a hydrated resource for encryption markers across input, output, metadata, error, and eventData fields.
• Persist features.encryption flag in executionContext at run creation so the UI can detect encryption without a probe fetch

How it works

A new DecryptClickContext (React context) threads the onDecrypt callback from EntityDetailPanel and EventListView down to all nested DataInspector and EncryptedFieldBlock instances. When the context is present, encrypted markers render as clickable "Decrypt" buttons; when absent (e.g. no decryption support), they remain static "Encrypted" labels.

The encryption probe in useWorkflowTraceViewerData fires a background request for 1 event with withData: true after the initial load completes. If any field in the hydrated response is an encryption marker, hasEncryptedData is set to true and propagated to the UI.

Test plan

• Open a run with encrypted data → Decrypt button appears in trace and events tabs without selecting a span
• Expand an event row in the events tab → inline "Decrypt" label is clickable
• Select a span in the trace tab → "Decrypt" button in attribute panel fields is full-width and clickable
• Click any "Decrypt" marker → triggers decryption flow, data resolves
• Open a run without encrypted data → no Decrypt button appears

[karthikscale3]

I think @TooTallNate recently added an encryption tag to the run's context object. Should that be used as a way to detect encryption without fetching an event separately?

Great, yes, that would make this simpler. Will look

The change from #1652 added features.encryption to WorkflowMetadata which is a runtime-only value available inside workflow code via getWorkflowMetadata(). It's computed on-the-fly from whether an encryption key exists. So this wouldn't work for us since the executionContext still doesn't have this flag. I made a change in this PR to persist this flag in the executionContext so runs from this version can be inferred directly and over time we can remove the probe fallback.

[workflow-devkit-release-bot]

Backported to stable (df115fd -> f1cc68f).