Add per-entry write visibility & encrypted snapshot (diagnostic support)

[harrytmthy]

Background

Current lifecycle signals (SafeBoxState) are coarse and instance-scoped. They don't reveal which entries are pending, being written, or persisted. For troubleshooting, demos, and education, we need finer-grained, per-entry diagnostics and a safe way to prove-at-a-glance that stored data isn't plaintext.

Goal

Add non-breaking, opt-in diagnostics for:

1. Per-entry write events that expose the write pipeline (queued → writing → persisted / removed).
2. A debug-only encrypted snapshot of the in-memory map to demonstrate ciphertext-at-rest.