Go SDK: decrypt json_tree extracted entries and subtree walks #1352

Background

json_tree lets SQL pull out one node of an encrypted document (col -> selector), or walk a subtree with a token (eql_v4.json_tree_subtree). The client then decrypts what comes back. If a walk runs over its budget, SQL returns the whole sealed document instead, and the client selects the subtree itself.

Problem

Go has no way to decrypt an extracted entry or a walk result.

• A walk's key carries its path, and that path is not sent to the database. Opening the rows needs the key, so this cannot be a plain record decrypt and needs a new guest entry point.
• The design leaves one check open: the client does not yet confirm that a returned entry is the one at the path it asked for (docs/plans/2026-10-17-json-tree-index.md).

Proposal

1. Fields.X.OpenEntry(ctx, c, []eql.JSONTreeEntry) returns the scalars. A container is refused, as the engine refuses it.
2. Fields.X.SubtreeKey(ctx, c, path) returns a key that binds as the token and gates. key.Open(ctx, c, rows) rebuilds the value, including the fallback through the sealed root.
3. Add a guest export for opening a walk.
4. Live tests: walks, the sealed-root fallback, and a node that is not a scalar.

Waits on the Go SDK issue, and on the design doc's selector check.

Plan: docs/plans/2026-10-24-go-json-tree.md, step 5.