Summary

• add the new internal leaf module :foundation-crypto-keys and wire it into the root build
• move the full main-source network.crypta.crypt and network.crypta.keys boundary into that leaf without changing package names
• move the residual generic helper blockers into :foundation-support, and move BucketTools plus PrependLengthOutputStream into :foundation-crypto-keys
• keep the extracted persistence helpers working by fixing the reflective BucketTools bridge for inherited FileBucket.split(int) lookup and pooled RAF restore
• add focused regression tests for persistent file-bucket splitting and pooled RAF restore via BucketTools

Validation

./gradlew :foundation-support:compileJava :foundation-crypto-keys:compileJava :compileJava
./gradlew test --tests 'network.crypta.support.LoaderTest' --tests 'network.crypta.support.SimpleReadOnlyArrayBucketTest' --tests 'network.crypta.support.StringValidityCheckerTest' --tests 'network.crypta.support.io.FilenameGeneratorTest' --tests 'network.crypta.support.io.FilenameSanitizerTest' --tests 'network.crypta.support.io.BucketToolsTest' --tests 'network.crypta.support.io.PrependLengthOutputStreamTest' --tests 'network.crypta.support.io.PooledFileRandomAccessBufferTest' --tests 'network.crypta.keys.*' --tests 'network.crypta.crypt.*'

Notes

• package names and behavior are unchanged; this is a physical ownership/build-boundary extraction
• tests remain in the root project for this PR