Add post-quantum Age support for PaperSecret

[c1-squire-dev]

Summary

• require AGE_SUITE_MLKEM768X25519 for internal and external PaperSecret creation and reject omitted, legacy, unknown, or mismatched create responses
• encrypt text and streamed file content with the canonical filippo.io/age v1.3.1 hybrid recipient implementation
• generate fresh hybrid reader identities for text and file reads; canonical Age decryption fails closed on non-hybrid ciphertext
• add behavior-focused coverage for exact create endpoints and request/response suite handling, authenticated HTTP transport preservation, hybrid stanzas, downgrade rejection, and text/file round trips

Current-behavior audit

Before this change, cone omitted the create suite request, did not inspect a returned suite, parsed create recipients as X25519, generated X25519 reader identities, and therefore only supported the legacy Age suite. It could silently accept the API compatibility default during creation.

This change assumes and targets merged ductone/c1 PR #21494 (merge commit 5f8a3873f3537e035923f1e5117d86ca2f7d8f2d). Authenticated GetContent intentionally negotiates through the self-describing hybrid reader recipient and has no suite fields; cone sends only a fresh hybrid recipient and decrypts only with its matching hybrid identity.

SDK follow-up

As of this PR, the latest published conductorone-sdk-go release is v1.28.2 and the available generated v1.29.0 PR predates c1 #21494. Neither exposes the merged create requiredAgeSuite / response ageSuite fields. pkg/client therefore contains a narrow temporary wire bridge for only /api/v1/secrets/internal and /api/v1/secrets/external. It uses cone’s configured authenticated HTTP client and existing generated request/response models. Replace this bridge with generated SDK fields once a post-#21494 SDK revision is published; no raw HTTP use was added for other PaperSecret operations.

Verification

• go test ./pkg/client ./cmd/cone
• golangci-lint run ./pkg/client/... ./cmd/cone/...
• make build
• git diff --check