test(TC-887): base32 runs end at their own alphabet; name 3+ salt pieces as out of scope

[samgbafa]

TC-887 harness: the two non-blocking nits from the #340 approval. No product code changes.

What changed (tests/at_rest_harness.rs, scripts/at-rest-harness/README.md)

1. A base32 run followed by another character is now found. The scan used to cut text into runs only at characters outside the union of all its alphabets. A base32-encoded key followed by 9 or 1 stayed inside a longer run that didn't decode as base32.
   • Runs of 32 or more characters are now also cut per alphabet (base32, hex, base64url); the union run is kept too.
   • Each run is decoded at the same 0–7 character shifts.
   • Mirror strings now get the same run scan as block bodies.
   • The README says so.
2. README out-of-scope list: it now names "a secret split into 3 or more pieces across salts (each under 16 bytes)".

How it's tested

• New selftest_base32_secret_before_other_characters:
  • base32(KEK_1) followed by 9 and by 1 after the ciphertext of a block body;
  • base32(ARK_1) followed by 9 and by 1 in an extra field of a DEK mirror.
    With the old union-only runs put back, it misses all 4 cases; with the fix, it passes.
• cargo test -p tinycloud-node --test at_rest_harness: 11 passed, 4 ignored. cargo clippy … --test at_rest_harness -- -D warnings and cargo fmt --check are clean.

[samgbafa]

APPROVE: see TC-887 (head c2c8aa8161d97f4fe445fb2c1b8779cc26c90bce)