Fail-closed sync encryption and cancellation

When encryption setup is cancelled, disable sync even if it was previously enabled and require explicit passphrase re-enablement; cancellation itself performs no synchronization. For incoming encrypted sync, any wrong or tampered ciphertext, corrupt or missing wrapped DEK, absent scope key, failed scope lookup, decryption failure, or encryption-OFF state must defer the affected table, freeze its cursor, and store nothing. Do not retain ciphertext or advance the cursor: that can strand undecryptable rows or expose ciphertext as knowledge content. These paths deliberately fail closed to prevent plaintext synchronization after encryption becomes mandatory.