Tasks — crypto-spec-conformance

Rewrite openspec/specs/crypto/spec.md to reflect the actual façade surface (AEAD, sign, agree, sealed-box, auth-box, primitives, errors, RNG callsite). Fill ## Purpose. Drop the moved hash / KDF / argon2id requirements (those now belong to @suaveplan/crypto-hash's spec).
Add **Verified by:** line to every ### Requirement: block in the folded spec.
Add src/crypto.spec-conformance.test.ts covering engine pluggability across all namespaces, AEAD nonce invariant, AEAD-failure no-leak, sign-verify boolean contract, x25519 stability, primitives loop body / mutation invariants, single crypto.getRandomValues callsite, error registry coverage, and frozen registry.
Confirm bun scripts/openspec-conformance.ts @suaveplan/crypto exits 0.
Confirm bunx turbo lint typecheck test --filter=@suaveplan/crypto is green.
Confirm bunx turbo test:coverage --filter=@suaveplan/crypto reports 100/100/100/100.