docs(specs): add S04-C column-level encryption wiring spec

What

Adds the S04-C specification — the composition-root activation of the S04-A column-level encryption stack — plus its docs/specs/README.md index row.

Scope the spec fixes: the wireEncryption tier (skip-iff-absent, fail-closed present-block path), the root-key load chain through infrastructure secrets, known-URI derivation before zeroization, store/manager/encryptor construction off the single loader TTL, sweeper cleanup on both shutdown paths, the wiring-bundle enablement signal for per-format consumers, and the crypto_fallback_unwraps_total counter with cardinality coercion. FIPS posture is service-wide AR compliance work, outside S04's scope. Security review gates (AppSec + internal) run once over the completed implementation, before the encryption block is enabled in any deployed environment.

Ride-along

One additional index row: S04-B (re-encrypt rotation tooling, tracked by its group epic) as Planned — documents the S04 family sequence between S04-A and S04-C. No S04-B spec file exists yet by design.

Notes

• Opens with **Status:** Approved per the spec-MR guardrail; merging is the approval signal.
• The implementation plan follows in its own MR once this lands; implementation MRs follow the plan.

Related to https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/492