Require canonical private seal envelopes

[biru-codeastromer]

Summary

• require the exact v1 outer, KDF, and cipher field sets
• reject padding and standard-base64 spellings for fields documented as canonical unpadded base64url
• retain SS040 for malformed envelope inputs and preserve all SplitSeal-generated v1 seal bytes

Compatibility

Every seal emitted by SplitSeal 0.1 and 0.2 already uses the accepted exact fields and canonical unpadded base64url. This tightens only previously accepted malformed or extended envelope spellings; the schema and cryptographic parameters do not change.

Evidence

• make release-gate: 103 passed, 1 optional skip, 91.78% coverage
• 20 crypto cases cover round trips, randomization, wrong keys, tampering, unknown/missing fields, padding, standard alphabet, noncanonical plaintext, and key length
• clean wheel install, dependency/text/repository audits, example workflow, and Gitleaks passed

This PR is independent of #22-#28 and is ready for maintainer review.

[biru-codeastromer]

The boolean KDF-parameter blocker is fixed at the new head. All scrypt numeric fields now require type(value) is int plus the exact supported value; p: true and numerically equal floats are rejected as SS040. Exact local gate: 107 passed, 1 optional skip, 91.78% coverage, repository/dependency/text audits, clean installs, example, and full-history Gitleaks all green.

[biru-codeastromer]

Superseded by merged #41, which preserves this change in the protected v0.4.0 release stack.