#998 Encryption keys: env wins over platform file with no drift guard (HIGHWAY_ENCRYPTION_KEY, RBAC_MASTER_ENCRYPTION_KEY)

EARS: When the JSONB encryption key or the RBAC master key is configured in both the environment and the platform secret file, the system shall fail unless both hold the same value; the file shall be the source of record. FOUND in #924 review (M3): engine/security/encryption.py get_encryption_key and encryption_keys.get_rbac_master_key read os.environ first (HIGHWAY_ENCRYPTION_KEY / RBAC_MASTER_ENCRYPTION_KEY) and only then Config.get_secret('encryption_keys'/'rbac_keys'); the Config drift guard (file vs SECRET_<NAME>) does not cover these env names, so a later move to files can silently disagree with env. Fix together with moving the env-held platform secrets to files (follow-up of #924).