eql-types: canonical EQL v3 payload types (Rust)

[coderdan]

Tracking issue for the crates/eql-types foundation.

Implemented by #236 (merged).

Goal

A single Rust source of truth for EQL v3 payloads — one struct per eql_v3 SQL domain — so every tool that produces/consumes EQL payloads (cipherstash-client, protect-ffi, CipherStash Proxy) stops hand-copying and drifting shapes. Replaces the runtime key-sniffing (e.g. term.k === 'ct' && term.hm) that produced the protect-dynamodb guard bugs.

Delivered

• Capability-encoded types mirroring eql-scalars::CATALOG (one per SQL domain), envelope (v/i/c) + index terms as required fields — no Option.
• Reusable term newtypes (Ciphertext, Hmac256, OreBlockU64_8_256, BloomFilter as signed i16).
• Drift protection in tests/catalog_parity.rs (registry covers CATALOG in order; behavioural required-keys round-trip).
• Joins the lean mise run test:crates set (fmt, clippy, test — no DB).

Stack

• feat: eql-types — canonical EQL v3 payload types (Rust) #236 — Rust contract (this issue)
• feat: eql-types — TypeScript bindings (stacked on #236) #268 — TypeScript bindings (ts-rs)
• feat: eql-types — JSON Schemas (stacked on #268) #269 — JSON Schemas (schemars)

[coderdan]

Completed in #236 (merged).