feat(core): add salted one-use GCM key wrapping

[kauandotnet]

Summary

• derive a one-use wrapping key from a fresh 256-bit salt, key reference, and canonical wrapping-context digest
• write the versioned 81-byte NESTM-A256GCM-HKDF-SHA256-SALT256-V2 wrapper
• retain read-only compatibility for legacy 61-byte A256GCMKW wrappers
• remove the database-restorable wrapper-nonce accounting requirement from the security contract

Validation

• full pnpm verify passed
• 203 unit tests passed
• 10 compatibility vectors passed
• package, publint, ATTW, and packed-consumer checks passed

Changesets schedules @nestm/crypto 0.1.0-alpha.4.