[Ilyes512]

Summary

• § Operations: the envelope field is encrypted_data; the break-glass command decrypted a real state object from the S3 backend in specsnl/specsops-opentofu#14 (PR specsnl/specsops-opentofu#24)
• § Operations: a missing or wrong identity surfaces in OpenTofu only as decryption failed for all provided methods, with the cause in tofu-age's stderr — and, with locking on, as a misleading Error acquiring the state lock error
• Decided: the external method is stable as of OpenTofu 1.13 (experimental in 1.10–1.12, label dropped in opentofu/opentofu@ebcf2c4), which closes that open item
• Decided: the checks from Verify tofu-age against real OpenTofu in the specsops-opentofu PoC #5 passed with tofu-age 0.1.0 against OpenTofu v1.13.1 in ghcr.io/specsnl/opentofu:0.2.0: envelopes for state and saved plans, a clean second plan, a wrong or missing identity fails, a saved plan applies

Closes #5