Add an encrypted variant: smoke_enc.hdb decrypted to tmpfs

Exercises the pass-2 path end to end — key lookup, decrypt into tmpfs rather
than the on-disk cache, results written into tmpfs and returned as an encrypted
.hrb the server stores without a key. The .hek stays out of the repo.

.gitignore

@@ -17,3 +17,6 @@ __pycache__/
 *.py[cod]
 .venv/
 *.env
+
+# Keys never enter the repo.
+*.hek

configs/tabular_encrypted.hcf

@@ -0,0 +1,92 @@
+{
+  "_notes": [
+    "Encrypted variant: the dataset arrives as smoke_enc.hdb and is decrypted",
+    "into tmpfs on the provider, never onto disk. Results follow the inputs and",
+    "come back as an encrypted .hrb the server stores without being able to read.",
+    "The provider needs f29fa64afbe1c51f.hek in its keys directory."
+  ],
+  "run_name": "tabular_encrypted",
+  "num_classes": 2,
+  "split_identity_level": 1,
+  "eval_stage": "cd_fuse",
+  "save_predictions": true,
+  "seed": 1234,
+  "folds": 3,
+  "fold_seed": 100,
+  "output_root": "results",
+  "data": {
+    "module": "hypertower_core.profiles.generic",
+    "args": {
+      "metadata_csv": "secret/smoke/labels.csv",
+      "id_column": "sample_id",
+      "label_col": "diagnosis",
+      "target_type": "classification",
+      "group_column": "patient_id",
+      "cat_cols": [
+        "site"
+      ],
+      "exclude_cols": [
+        "notes"
+      ]
+    }
+  },
+  "towers": [
+    {
+      "name": "cd",
+      "module": "hypertower_core.components.towers.clinical_tower",
+      "class": "ClinicalEncoder",
+      "data_source": "matrix",
+      "args": {
+        "hidden_dim": 64
+      }
+    }
+  ],
+  "stages": [
+    {
+      "name": "cd_warm",
+      "type": "warm",
+      "tower": "cd",
+      "head_name": "cd_aux",
+      "level": "sample",
+      "epochs": 8
+    },
+    {
+      "name": "cd_aux",
+      "type": "head",
+      "input": "cd",
+      "train_with": "cd_fuse"
+    },
+    {
+      "name": "cd_fuse",
+      "type": "fusion",
+      "module": "hypertower_core.components.bridges.mono_bridge",
+      "class": "MonoBridge",
+      "inputs": [
+        "cd"
+      ],
+      "level": "sample",
+      "epochs": 10,
+      "train_towers": true,
+      "args": {
+        "use_ln": false
+      }
+    }
+  ],
+  "training": {
+    "lr": 0.001,
+    "batch_size": 32,
+    "tune_binary_threshold": true
+  },
+  "data_bundles": [
+    {
+      "file": "smoke_enc.hdb",
+      "encrypted": true,
+      "mount": "secret",
+      "unpacked_mb": 1,
+      "sha256": "b4df36d1fe916891b679ac89a38ead7bc956783aa3ac1cc65d3becc8cb26523d"
+    }
+  ],
+  "dataset": {
+    "n_samples": 400
+  }
+}