security: Make encryption always-on with auto-cleanup

BREAKING CHANGES:
- Encryption is now ALWAYS enabled (cannot be disabled)
- Removed DG_CACHE_ENCRYPTION environment variable

Security Enhancements:
- Encryption is mandatory for all cache operations
- Ephemeral encryption keys per process (forward secrecy)
- Automatic deletion of corrupted cache files on decryption failures
- Auto-cleanup on both decryption failures and SHA mismatches

Changes:
- Removed DG_CACHE_ENCRYPTION toggle from CLI and SDK
- Updated EncryptedCache to auto-delete corrupted files
- Simplified cache initialization (always wrapped with encryption)
- DG_CACHE_ENCRYPTION_KEY remains optional for persistent keys

Documentation:
- Updated CLAUDE.md with encryption always-on behavior
- Updated CHANGELOG.md with breaking changes
- Clarified security model and auto-cleanup behavior

Testing:
- All 119 tests passing with encryption always-on
- Type checking: 0 errors (mypy)
- Linting: All checks passed (ruff)

Rationale:
- Zero-trust cache architecture requires encryption
- Corrupted cache is security risk - auto-deletion prevents exploitation
- Ephemeral keys provide maximum security by default
- Users who need cross-process sharing can opt-in with persistent keys

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/deltaglider/client.py

@@ -1159,13 +1159,9 @@ def create_client(
         # Filesystem-backed with Content-Addressed Storage
         base_cache = ContentAddressedCache(cache_dir, hasher)
 
-    # Apply encryption if enabled (default: true)
-    enable_encryption = os.environ.get("DG_CACHE_ENCRYPTION", "true").lower() == "true"
-    cache: CachePort
-    if enable_encryption:
-        cache = EncryptedCache.from_env(base_cache)
-    else:
-        cache = base_cache
+    # Always apply encryption with ephemeral keys (security hardening)
+    # Encryption key is optional via DG_CACHE_ENCRYPTION_KEY (ephemeral if not set)
+    cache: CachePort = EncryptedCache.from_env(base_cache)
 
     clock = UtcClockAdapter()
     logger = StdLoggerAdapter(level=log_level)