fix(declarative): make encrypt_fields produce policies idempotent

[rspurgeon]

An unchanged encrypt_fields produce policy planned an UPDATE after apply
because Konnect adds the static key name inside the config array. Compare
array elements recursively, using the existing config-map subset semantics,
while preserving array order, length, and explicitly configured values.

Expand the produce-policy E2E scenario to create an encrypt_fields child
of the existing schema-validation policy, verify the field path and exact
parent/key IDs, confirm a no-op plan, and sync-delete the child and key.
The overlay recreates the earlier static-key fixture and uses the API's
canonical bracket notation for the field path. Regression tests cover
API-added fields, changed key references, and array comparison behavior.

Closes #2167.

Validation:

• CGO_ENABLED=0 go fix ./...
• make format (clean after formatting), make build
• make test-all targets passed, with lint's --allow-parallel-runners
  option and the installed ShellCheck 0.11.0 selected for this run
• CGO_ENABLED=0 make test-e2e-scenarios SCENARIO=event-gateway/produce-policy

E2E artifacts: /home/rspurgeon/go/e2e-artifacts/20260915-225639

[kong-api-ops]

✅ KSAI Review: Finished

1. 04:01 UTC Reviewing changed files and the diff under review
2. 04:06 UTC Searching the codebase to verify a helper's usage

---

Run report (federated) · 1 paid run · $0.0976 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	zai-org/GLM-5.3-Flash/high	60	$0.0974

Reviewing cost $0.0974; deciding how to run it cost $0.0002

[kong-api-ops]

Check	Result
Scope	Planner config-comparison fix (configFieldsMatch/configValuesMatch), new unit tests, and encrypt_fields e2e lifecycle scenario
Mandate	go-code-reviewer (Go files), default-code-reviewer (e2e YAML)
Findings	None
Findings audit	Skipped (no candidate findings)

The refactor preserves desired-subset map semantics and adds length- and order-sensitive array comparison with the same subset semantics for map elements. Both sides come from JSON round-trips, so []any/map[string]any type assertions hold; nil-versus-empty arrays still mismatch. I traced all three callers (cluster, produce, consume planners) and the __REF__ normalization path; the new tests exercise the exact regression (API-added name beside key.id). The e2e overlay states match earlier steps, so the 2-CREATE and 2-DELETE assertions line up. Additional Risk pass: no additional concerns found; the base64 static key value is a dummy fixture and the registry password uses !secret with an env source.