test(xmlenc): classify complete donor corpora

[polaz]

Problem

The XML Encryption implementation exercises selected vectors from the upstream Merlin and Aleksey suites, while the complete Phaos suite is already tracked and classified. This leaves corpus drift and unsupported paths under-specified: a new or changed upstream vector can remain untested without an explicit compatibility decision.

Implementation

• Import byte-for-byte snapshots of the complete merlin-xmlenc-five, 01-phaos-xmlenc-3, and aleksey-xmlenc-01 suites from the pinned libxmlsec1 donor checkout.
• Maintain a drift-proof inventory that assigns every encryption vector to an executable supported path, an exact malformed-input rejection, or a specific unsupported algorithm/resource/key-management boundary.
• Run supported decrypt vectors through the public decryption and document-replacement APIs and compare against donor plaintext.
• Run supported templates through the public encryption pipeline and verify reciprocal interoperability with libxmlsec1.
• Cover binary, Element, and Content semantics; direct keys, RSA-OAEP, and AES Key Wrap; wrong keys, tampering, malformed metadata, and authentication/integrity failures.
• Keep future legacy algorithms, key agreement/KDFs, external resources, and extended key-manager support explicitly classified rather than silently skipped or partially implemented here.
• Document fixture provenance, corpus accounting, and the supported/unsupported boundary.

Acceptance criteria

• Every encryption vector in all three suites is accounted for exactly once.
• Supported positive cases execute end to end through public APIs.
• Invalid cases assert the precise typed failure boundary rather than accepting any error.
• Unsupported cases name the exact algorithm or resource boundary and fail closed.
• Reciprocal libxmlsec1 checks cover every currently supported operation shape represented by the suites.
• Corpus accounting fails when tracked donor contents drift without an updated classification.
• Unit, integration, backend-feature matrix, clippy, all-feature build, and doctests pass.