docs(plans): add the S04-C encryption wiring implementation plan

What

Adds the implementation plan for the S04-C spec — composition-root activation of the S04-A encryption stack — plus its docs/plans/README.md index row.

Three sequential feat steps, each one MR:

1. Encryption tier seam and skip path — wire_encryption.go skeleton, skip-iff-absent, nil-client boot failure, interface-typed bootDeps factories, the bundle enablement-signal fields (spec ACs 1, 3).
2. Encryption tier activation — the present-block path (root-key load, known-URI derivation before zeroization, store/manager/encryptor off the single loader TTL, sweeper cleanup on both shutdown paths) plus the paired docs: the two fips.md corrections and the new docs/dev/column-encryption.md consumer guide (ACs 2, 4, 5, 8 and the nil-Secrets rule). Size (~550–650 LOC incl. ~250 doc lines) is pre-justified in-plan with a named split seam.
3. Fallback-unwrap counter — the counter vector, hook closure with known-URI coercion, cardinality budgets, catalog row (ACs 6, 7).

Stacking

Stacked on !1267 (merged) (the spec) so this diff is plan-only; retargets to main when the spec merges, per the project's stacked-MR practice. Draft until then.

Notes

• The public delivery issue for the step MRs' Related to lines is filed when this plan ships, linked from the delivery epic.
• Step MRs open sequentially after this plan merges, per the plan-MR guardrail.

Related to https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/493