fix(canopy-common): port CRAIG fail-closed encryption-mode guard

External review (2026-05-09) flagged that CRAIG has a fail-closed encryption-mode concept (craig-common/src/settings.rs:8) that canopy should evaluate for parity. The guard ensures that if encryption keys aren't loaded at startup, the service refuses to start rather than silently operating without encryption.

Action

1. Read CRAIG's implementation
2. Identify which canopy paths could silently degrade
3. Add equivalent guard

Refs

External review (2026-05-09).