docs(asvs 11.2.2): the crypto agility seam contract, and a false comment corrected by execution

[wshallwshall]

The written seam contract that ASVS 11.2.2 needs, plus a false comment in store/crypto.py corrected
by execution. Not a behaviour change: no default moves and no algorithm changes.

The requirement has two readings that cost very different things, so this commits to one

11.2.2 asks that cryptography be "reconfigured, upgraded, or swapped at any time". That is ambiguous in
a way that matters, so the document states which reading is claimed:

• COMMITTED -- a release can change an at-rest algorithm with no data migration and no unreadable
  ciphertext left behind.
• NOT COMMITTED -- an operator selecting an algorithm on a running instance.

The second is a refusal with a stated price, not an unbuilt feature, and the price is what makes it a
decision rather than an omission: an algorithm identifier is read from three places -- config (the
operator chooses), the wire (the token minter chooses), and stored data (mfenc:v2's alg segment,
so whoever can write a store row chooses). A second registered AEAD lands in that third and most exposed
class, and turns a fail-closed one-way dispatch into a two-way dispatch keyed on attacker-writable
data.

The limit is pinned, because it is the half a reader loses first

The seam covers the at-rest value core and not the audit MAC or its KDF, which carry no version
discriminator at all. Any future claim that this project "has crypto agility" must exclude the audit
chain or be false. That sentence is pinned by a test rather than left in prose.

A false comment, settled by execution rather than by reading

messagefoundry/store/crypto.py:96 carried:

_V2_PREFIX = "mfenc:v2:"  # additive, decode-capable; not written by default

while the module docstring 60 lines above says v2 is "ON by default since ADR 0148 GIVEN 1, so the
default at-rest format is mfenc:v2". Two statements in one file, flatly contradicting.

Settled by running it, not by picking the more convincing sentence: StoreSettings().aad_bind is
True, so make_cipher receives write_v2=True and v2 is the shipped writer. The docstring was
right and the constant's own comment was wrong -- which is the worse way round, because the comment
sits on the thing it describes. A reader inspecting _V2_PREFIX meets the false statement first; the
true one is 60 lines away and easy never to reach.

Verification

8 new tests pin the contract, its LIMIT and its REFUSAL -- a published contract that nothing checks
is a claim, not a control.

Watched fail, each landing on its own assertion and no other, which is what distinguishes a test that
covers a property from one that merely passes beside it:

• reverting aad_bind to False reds only the shipped-default test
• neutering the unknown-alg branch reds only the fails-closed test

112 passed across the crypto / PHI-doc / cipher-selection slices; ruff and mypy clean on every touched
file.

Independently re-checked before merge: the branch is 0 behind main, merges clean (merge-tree
rc=0, read from the return code rather than the output shape), and the aad_bind = True claim was
re-derived by execution against the project interpreter rather than taken from the report.

Independent of #325 -- different files entirely, no interaction with the store signature change or
the SQL Server leg.