Bounded compatibility crypto for released-client attachment values.
Authenticate and decrypt one bounded released-client value.
Encrypt as nonce12 || ciphertext || tag16; large files use staged adapters.
nonce12 || ciphertext || tag16