Encrypting VFS — Milestone 2 (anti-rollback manifest + per-DB subkeys on header-free opfs-sahpool)

running… (compiling/opening in a worker)