stack-encrypt: dynamic::record::decrypt returns passthrough fields next to decrypted ones without saying they are not authenticated #1121

Background

In a stack-encrypt record plan, a field can be passthrough. That means it is stored as it is, unencrypted, so the record stays whole. The Output::Passthrough docs in packages/stack-encrypt/src/dynamic/record.rs say it is "unsealed and unauthenticated".

Problem

dynamic::record::decrypt puts passthrough values and decrypted values into one flat object, in plan order. A decrypted value is authenticated: if someone changes its stored bytes, decryption fails. A passthrough value is not. Anyone who can write to the database can change it, and decrypt still succeeds. record_row checks only its type.

The decrypt docs say that passthrough outputs take part, but not that their values are unauthenticated. So a caller can believe that every field in the result was checked.

(This affected Go's DecryptRecord when #1093 was reviewed. Further up that stack, Go keeps passthrough values on the Go side, so the gap that remains is in the Rust dynamic::record API and any binding that uses it.)

Proposal

1. Add this text to the docs of dynamic::record::decrypt: "A passthrough field comes back exactly as the store holds it. Anyone who can write to the store can change it, and decrypt does not detect the change."
2. Consider returning passthrough fields in their own map, so the type tells a caller which values are authenticated.

Found in the review of #1093.