Land reviewed datetime, cache, binary, and field-option fixes

[script3r]

Bring the already-reviewed datetime, cache, PostgreSQL binary, and field-option fixes into main.

PR #7 reached main, but #8, #9, #10, and #11 were merged into their predecessor branches after those predecessors had already landed. Those four changes are therefore marked merged on GitHub but are not yet in main. This integration PR contains their original four commits, without additional code changes:

• Fix timezone loss and time shifts in encrypted datetimes #8: preserve timezone-aware datetime reads and re-saves.
• Share Tink primitives and fix concurrent cache invalidation #9: share Tink primitives and synchronize keyset invalidation.
• Fix PostgreSQL binary-field corruption before encryption #10: encrypt binary buffer contents before PostgreSQL driver adaptation.
• Enforce resolved database options and remove implicit slug indexes #11: validate resolved database options and remove implicit randomized slug indexes.

The original PRs passed CI. This PR runs CI against current main again. Its tree has 130 library tests and 6 example integration tests. Existing ciphertext is unchanged except that already-corrupted PostgreSQL binary values require application-specific recovery. Encrypted slug users should generate and apply the index-removal migration.

Current landing order: merge this PR into main, then change #12's base to main before merging #12. If this head branch is deleted after merging, verify that GitHub automatically retargeted #12. Use a merge commit to preserve ancestry; squash/rebase merging requires rebasing #12.

Full review and rollout notes.