feat: replace private cas envelope

docs/roadmap.md

@@ -648,8 +648,12 @@ authorization and durable-state boundaries clear.
   - `[x]` `geth cas get-private <resource> <hash> --out <path>` decrypts with
     a matching local resource secret epoch.
   - `[x]` Access is gated by local resource secret epoch material.
-  - `[x]` Tests verify encrypted blob roundtrip and wrong resource/secret
-    rejection.
+  - `[x]` New writes use an AES-256-GCM envelope with resource-bound
+    associated data and random nonces.
+  - `[x]` Prototype BLAKE3-XOR envelopes from earlier pre-deployment builds are
+    rejected with a clear error.
+  - `[x]` Tests verify encrypted blob roundtrip, tamper detection, wrong
+    resource/secret rejection, old-envelope rejection, and nonce uniqueness.
   - `[x]` Docs explicitly avoid claiming forward secrecy or PCS.
 
 - `[x]` Iroh-docs KV integration.