test(e2e): cover decrypt_fields consume policy lifecycle

[rspurgeon]

The consume-policy E2E scenario did not exercise decrypt_fields.
Add a schema-validation parent and static key, then verify field-level
decryption creation, the exact parent link and returned config, no-op
replanning, sync deletion, and prerequisite cleanup.

Use Konnect's canonical bracket notation for the field path so the fixture
round-trips without normalization drift.

Closes #2168.

Validation:

• Go modernization, formatting, and build passed.
• Lint passed with zero issues (--allow-serial-runners to wait for another
  local lint process).
• Unit, integration, installer, and E2E tooling tests passed.
• make test-e2e-scenarios SCENARIO=event-gateway/consume-policy passed.
• Local E2E artifacts:
  /home/rspurgeon/go/e2e-artifacts/20260915-225157.

[kong-api-ops]

✅ KSAI Review: Finished

1. 03:59 UTC Auditing declarative planner behavior against test scenarios

---

Run report (federated) · 1 paid run · $0.0353 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	zai-org/GLM-5.3-Flash/high	23	$0.0352

Reviewing cost $0.0352; deciding how to run it cost $0.0001

[kong-api-ops]

Check	Result
Scope	Two new declarative overlays and E2E scenario steps 013-016 covering a decrypt_fields child consume policy (create, verify, idempotency, sync-delete)
Mandate	default-code-reviewer
Findings	2 Low
Findings audit	Completed

The new steps match proven patterns in this scenario: delete plans key on resource name, nested empty lists signal sync deletes, and static-key plaintext drift does not break idempotency re-plans. No additional concerns found in the secrets, security, or leak dimensions.