Encrypt private ledger data directly into serialised entries

[Copilot]

Private-domain serialization allocated temporary GCM and ciphertext buffers, then copied them into the ledger entry. This change encrypts into the final entry while preserving its byte format and public-domain AAD.

• Direct output: Add caller-owned output spans for AES-GCM, transaction encryption, and GCM header serialization. Keep vector APIs and support vector-only encryptor implementations.
• Entry assembly: Reserve the complete layout once; write public bytes and encrypt private bytes at their final offsets. Failed encryption cannot return or replicate a partial entry.
• Compatibility: Cover public-only, private-only, mixed, and empty-private entries, plus snapshots, historical secrets, replay, and AAD authentication.
• Measurement: The nonempty-private path removes three temporary allocations and copies of 28 header bytes plus the ciphertext. Paired 64-byte AES-GCM medians improved from 945 to 935 ns/op with a fresh context and 312 to 305 ns/op with a reused context; KV timings were within noise. A full pi_basic A/B profile remains outstanding.

Closes #8169

• Fixes Encrypt private ledger data directly into serialised entries #8169