refactor(store): move private overlay domain into module

[freezscholte]

Summary

• move private path labels, encrypted private payloads, overlay transport/materialization, and org encryption key binding into crates/forge-store/src/private_overlay.rs
• preserve the existing store public API through lib.rs re-exports
• keep snapshot/review callers wired through crate-private helper re-exports while later slices continue shrinking lib.rs
• lower the store lib.rs line-count cap from 11,776 to 10,460 and update ADR-0001 with the NER-374 audit note

Verification

• rtk cargo check -p forge-store
• rtk cargo test -p forge-cli --test forge_encrypted_private_content
• rtk cargo test -p forge-cli --test forge_visibility
• rtk cargo test -p forge-cli --test forge_secret_export
• rtk cargo test -p forge-cli --test forge_accept_export
• rtk cargo test -p forge-cli --test forge_sync
• scripts/check-rust-line-count.sh
• rtk cargo fmt --all --check
• rtk cargo test --workspace — 603 passed across 61 suites
• rtk cargo clippy --workspace --all-targets -- -D warnings
• rtk bash scripts/ci.sh — PASS=95 FAIL=0

Fixes NER-374.
Related NER-371.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}