Improve forensics encrypted imaging feasibility gates

[danyili2632]

Summary

• add an encryption feasibility gate before powered-off disk imaging
• require recovery-key escrow, test unlock, live-session fallback, and cloud KMS decrypt/copy evidence
• extend cloud snapshot guidance, severity escalation, report output, and pitfalls for encrypted evidence acquisition

Bounty

Addresses #1526.

I have read and agree to the CONTRIBUTING.md bounty terms. Preferred payment method can be provided privately after maintainer acceptance.

Validation

• git diff --check