Encrypt local run artifacts at rest

[matthewod11-stack]

Problem\n\nSourcerer currently writes local run artifacts under runs/<date-role>/ as plaintext JSON/Markdown. These files are gitignored and documented as local single-user artifacts, but they can contain PII such as email, phone, address fields, source URLs, adapter provenance, collection timestamps, and retention metadata.\n\nThis is acceptable for the current local-dev posture, but not for shared machines, synced folders, multi-user servers, or hosted deployments.\n\n## Proposed follow-up\n\nDesign optional at-rest protection for run artifacts. Possible directions:\n\n- Encrypt candidates.json, checkpoint.json, and any PII-bearing output files with a local key.\n- Keep run-meta.json non-sensitive where possible so run listing stays ergonomic.\n- Add clear key-management guidance and failure modes.\n- Preserve sourcerer candidates purge --expired semantics for encrypted artifacts.\n- Document migration behavior for existing plaintext runs.\n\n## Out of scope\n\nThis issue does not block the current H-13 documentation work. H-13 only makes the plaintext-at-rest posture explicit.\n\n## Acceptance\n\n- Proposed design covers key storage, encrypted files, metadata visibility, purge behavior, and migration.\n- Implementation includes tests proving PII-bearing artifacts are not readable as plaintext when encryption is enabled.\n