rstack dev: field encryption, profile scope checks and failure-path test realism #2640

Follow-up to #2635 and #2637. Gaps in what rstack dev supports and checks, and in how its tests exercise failure paths.

Field encryption

rstack dev check and start refuse a BReg project with encrypted fields. Support local-file key custody for development runs: generate a per-run key in the run's owner-only directory and remove it with the run.

Grant scopes

The run does not compare a grant's scopes with the selected profile, because a profile's required scopes are a per-entity rule; a mismatch shows up as a failed journey step. Once an offline rule exists for "scopes this profile can use", check it in check and start.

Test realism

• The administrator connection deadline test times out a pending future, not a stalled socket. Add a listener that accepts TCP and never answers TLS, and cover the cleanup reconnection path as well as the first connection.
• The worker size test writes the captured run input as hand-written JSON. Build it from the RunInput type so a field rename fails at compile time.

macOS

Linux CI runs the unit, integration and acceptance tests. The macOS contributor job does not run the project_dev tests. Add them there if macOS developers hit platform differences (TLS roots, temporary directory paths, process groups).