feat(temporal): add payload codec foundation

[daryllimyt]

Checklist

• Read CONTRIBUTING.md.
• PR title is short and non-generic (see previously merged PRs for examples).
• PR only implements a single feature or fixes a single bug.
• Tests passing (uv run pytest tests)?
• Lint / pre-commits passing (pre-commit run --all-files)?

Description

Related Issues

Screenshots / Recordings

Steps to QA

---

Summary by cubic

Adds a composable Temporal payload codec with workspace-scoped AES‑256‑GCM encryption, optional compression, and deterministic visibility tokenization. Also hardens file validation imports and pins chardet to avoid polyfile issues.

• New Features

  • AES‑256‑GCM payload encryption using HKDF‑derived per‑workspace keys with versioning and caching.
  • Composite codec via get_payload_codec with optional compression (zstd/gzip/brotli) and encryption.
  • Deterministic HMAC tokenization for Temporal visibility values.
  • Workspace scoping via ctx_temporal_workspace_id and with_temporal_workspace_id(...); falls back to a global scope when unset.
  • Data converter now uses the codec and switches to DefaultFailureConverterWithEncodedAttributes when encryption is enabled.
  • Config flags for enabling encryption, key sources and caching, visibility HMAC, and codec server shared secret.

• Bug Fixes

  • Lazy-load polyfile.magic in file validation and return a generic "Unknown or unsupported file type" when optional transitive deps are missing.
  • Pin chardet to 5.2.0 and add it to app dependencies to satisfy polyfile.

^{Written for commit 01eb50c. Summary will update on new commits.}

[daryllimyt]

• feat(temporal): add payload encryption codec with fail-open semantics #2297
• feat(temporal): encrypt durable agent histories #2296
• feat(temporal): encrypt core workflow histories #2295
• feat(temporal): add payload codec foundation #2294 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[daryllimyt]

Collapsed into #2297.

[daryllimyt]

Superseded by #2297: #2297