fix(rustd): afd_crypto — check the wrapped DEK, stop claiming lowercase

Two review findings on §1, both places where the code and its own contract
disagreed.

`Envelope::from_parts` narrowed and length-checked every fixed-width
component except the wrapped DEK, which it took as an unvalidated `Vec`.
That column is fixed-width too — a detached AES-GCM ciphertext is as long
as its plaintext, and that plaintext is always a `KEY_LEN` key — so a
truncated row reached the AEAD and came back as an unopenable envelope
rather than as the malformed row it is. It is now refused at the boundary,
named, with the same `ComponentLength` error every sibling component uses.

The key-hex error said "lowercase hex characters" while `hex_digit` accepts
`A-F`, and a test proves either case decodes. An operator reading that
message goes and re-cases a key whose only fault was its length. The
message and the `is_key_hex` doc now say what the decoder does.

Tests: three wrong-length wrapped DEKs (empty, 31, 33) each refused as
malformed with the component named, and the length error asserted not to
blame capitalisation. 236 unit tests pass; coverage holds at 99.62%.