feat(filecrypt): per-area keys (BLAKE2s), per-file salt, XChaCha20-Poly1305 chunks bound to index+last, seed DRBG w/ fast key erasure

Cargo.toml

@@ -15,6 +15,7 @@ members = [
     "crates/elf",
     "crates/manifest",
     "crates/keystore",
+    "crates/filecrypt",
     "crates/ports/entropy",
     "crates/drivers/rng/virtio",
     "crates/tools/app-image",
@@ -76,11 +77,13 @@ domain = { path = "crates/domain" }
 elf = { path = "crates/elf" }
 manifest = { path = "crates/manifest" }
 keystore = { path = "crates/keystore" }
+filecrypt = { path = "crates/filecrypt" }
 # Audited RustCrypto implementations; never our own.
 argon2 = { version = "0.5", default-features = false }
 chacha20poly1305 = { version = "0.10", default-features = false }
 blake2 = { version = "0.10", default-features = false }
 zeroize = { version = "1", default-features = false }
+chacha20 = { version = "0.9", default-features = false }
 port-entropy = { path = "crates/ports/entropy" }
 driver-rng-virtio = { path = "crates/drivers/rng/virtio" }
 platform = { path = "crates/platform" }