refactor: rename customer-facing surface from "protect" to "encryption"

[calvinbrewer]

Summary

Brand alignment: this is the CipherStash Stack's Go Encryption SDK — not "Protect" anymore. This PR renames every customer-facing use of protect to encryption, and intentionally leaves the FFI internals unchanged (per agreed scope).

Note

Stacked on feat/client-0.40-eql-v3 (PR #6) so the diff is a clean, mechanical rename. Base retargets to main automatically when #6 merges. Review #6 first.

What changed (customer-facing)

Surface	Before	After
Module path	github.com/cipherstash/protectgo	github.com/cipherstash/goencryption
Package dir	pkg/protect	pkg/encryption
Package name	package protect	package encryption
Public API	protect.NewClient(...)	encryption.NewClient(...)
Error namespace	"protect: ..."	"encryption: ..." (all messages + sentinels)
Main source files	protect.go, protect_test.go	encryption.go, encryption_test.go

Docs (README, DEVELOPMENT, CONTRIBUTE), the example, and the CI copy/test paths were updated to match.

What was deliberately NOT renamed (FFI internals)

These are implementation details users never import or call, so they keep the protect name to avoid a rebuild-all-binaries + four-way-filename-sync churn for zero user-visible benefit:

• Rust crate protect-ffi-c and library protect_ffi / libprotect_ffi_*.a
• C ABI symbols (protect_new_client, protect_encrypt, …) and the generated header protect_ffi.h
• The cgo bridge callback protectgoGetToken and shims protectNewClient*

build.rs and the CI workflow were updated only where they reference the package directory path (now pkg/encryption/), not the library names.

Guardrails applied during the rename

• The selector replace was scoped to protect. + uppercase (all Go exported identifiers), so the license badge URL @cipherstash/protect.svg and the FFI symbols (protect_, protectgo…) were never touched.
• Verified post-rename: zero customer-facing protect remains (module path, package selector, error namespace, doc paths); FFI internals confirmed intact (crate name, 8 C symbols in the header, 6 static libs with original names, cgo linkage).

Verification

• gofmt clean; go build ./... and go test ./... green under the new module path.
• Live encrypt/decrypt round trip against ZeroKMS through encryption.NewClient — model, bulk, query, and IsEncrypted flows all pass.

Follow-up required (outside this PR)

The GitHub repo must be renamed to goencryption for go get github.com/cipherstash/goencryption/pkg/encryption to resolve. GitHub 301-redirects the old protectgo URL, so existing clones keep working. I left this as a manual step since it's an org-level action — say the word and I'll do it via gh repo rename.

🤖 Generated with Claude Code