vcencrypt: refusing an all-passthrough container surfaces as ErrInternal #385

Problem

The AES cipher deliberately refuses to seal a non-empty array or object whose children are all passthrough values. Nothing in such a container would authenticate the AAD, so it would decrypt under any AAD (see AesSeqCipher::end in packages/encrypt/src/cipher.rs).

From Go, that refusal is indistinguishable from a guest crash:

_, err := cipher.Encrypt(ctx, map[string]any{"id": vcvalue.Plain{V: int64(42)}}, aad)
// err == ErrInternal

The cause:

• Value::encrypt_with_aad returns Unspecified.
• The guest's encrypt maps every encryption error to STATUS_INTERNAL.
• The Go host maps that status to ErrInternal, which is documented as "a guest panic or any other unexpected internal failure".

A caller who wrote a record with only Plain fields gets an error that suggests a bug in the library, not in their input.

The differential fuzzing work in #384 found this: [passthrough(undefined)] decodes fine on both sides, but the guest won't encrypt it.

Proposal

Report this case as its own error. Two options:

• A new guest status code and Go sentinel, for example ErrNothingToSeal. This changes the guest/host contract: a new status value, mirrored in client.go.
• Check on the Go side, before calling the guest. This duplicates Rust's rule in Go, and the two copies could drift apart.

The first keeps the rule in one place. Either way, the error should say why the value can't be encrypted: a container with no sealed values has nothing to authenticate it.

Also worth checking whether other encryption-time refusals reach callers as ErrInternal in the same way.