test(vectors): pin empty-file framing across impls (FIL-518)

[bajtos]

While reviewing the acceptance criteria for FIL-518, Claude flagged a missing test. This pull request is adding it.

The empty object is its own STREAM framing case: it encodes as one empty final chunk, so the body is a bare 16-byte tag with nothing to authenticate. Until now that case was only covered by Go-internal tests, so a divergence from the foc-encryption reference on the case most likely to diverge would have gone unnoticed (FIL-518 AC3).

• Add empty-file-go (Go seals, the reference decrypts) and empty-file-ts (the reference seals, Go decrypts).
• Assert the ciphertext length against aesstream.EncryptedSize for every fixture, so the one-tag-per-chunk framing is pinned rather than implied by a successful decrypt.
• Make the TS driver table-driven and skip a fixture already on disk unless FEE_VECTORS_REGEN=1, so generating a new TS fixture no longer rewrites a committed blob (the reference draws a random base nonce per encrypt).

The pinned reference decrypts both new fixtures: all six fixtures pass under ./vectors/pull-foc-encryption.sh.

[Copilot]

🟢 Ready to approve

Changes are isolated to test vectors/tooling and the added assertions/fixtures align with the documented STREAM framing rules, with only a minor optional robustness improvement noted for TS fixture regeneration skipping.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds cross-implementation test vectors to pin the AES-256-GCM-STREAM empty-plaintext framing case (tag-only body) in both Go→TS and TS→Go directions, and strengthens vector validation by asserting ciphertext sizing/framing.

Changes:

• Add new empty-file fixtures (empty-file-go, empty-file-ts) and document the empty-file framing rule.
• In TestVectors, assert ciphertext length via aesstream.EncryptedSize(...) for every fixture to pin “one tag per chunk” framing (including empty plaintext → 1 empty final chunk).
• Refactor the TS vector generator to be table-driven and avoid rewriting committed blobs unless FEE_VECTORS_REGEN=1.

File summaries

File	Description
vectors/vectors_test.go	Adds empty-file vectors and asserts ciphertext framing via aesstream.EncryptedSize.
vectors/ts/driver.ts	Makes TS fixture generation table-driven and adds “skip existing unless regen” behavior.
vectors/testdata/empty-file-ts/meta.json	Adds metadata for the TS-produced empty-file fixture.
vectors/testdata/empty-file-ts/plaintext.bin	Adds empty plaintext fixture payload (0 bytes).
vectors/testdata/empty-file-go/meta.json	Adds metadata for the Go-produced empty-file fixture.
vectors/testdata/empty-file-go/plaintext.bin	Adds empty plaintext fixture payload (0 bytes).
vectors/README.md	Documents empty-file framing and updates fixture/regeneration instructions.

Review details

• Files reviewed: 5/9 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.