[GoDeskio]

Design and blocker notes only.

• FIPS (feat(core): FF1 format-preserving encryption (NIST SP 800-38G) #17): needs the aws-lc FIPS build in CI and Dustin's go-ahead. The design uses a provider trait.
• External audit (docs: normative envelope wire-format spec + vector walkthrough #19): needs a vendor and budget.
• FHE (feat(core): hybrid X25519 + ML-KEM-768 key wrap #20): a watch item, no code.