Finish xtest CLI for cross-SDK interoperability

[arkavo-com]

Goal

Add the OpenTDFKit Swift SDK to the opentdf-tests cross-SDK compatibility matrix so that Swift-produced TDFs can be decrypted by the reference SDKs (and vice versa).

Background

• OpenTDFKit is a Swift implementation of OpenTDF supporting both NanoTDF and TDF (Archive Envelope) formats.
• The upstream opentdf/tests repository runs xtests across the official SDKs to ensure interoperability.
• This fork exists to add Swift coverage and drive the required CLI/API changes in OpenTDFKit.

Current State

The OpenTDFKit repo has a partial xtest/cli.swift stub, but it is not yet functional for cross-SDK testing:

• ZTDF / ztdf-ecwrap encrypt and decrypt are not implemented (they exit(1)).
• NanoTDF decrypt only parses the header and writes a placeholder; it does not recover plaintext via KAS rewrap.
• The CLI interface and environment-variable contract need to match what the xtest harness expects.

Acceptance Criteria

• Finish the Swift xtest CLI in OpenTDFKit so it supports:
  • encrypt <plaintext> <ciphertext> nano
  • encrypt <plaintext> <ciphertext> nano-with-ecdsa
  • encrypt <plaintext> <ciphertext> ztdf
  • encrypt <plaintext> <ciphertext> ztdf-ecwrap
  • decrypt <ciphertext> <recovered> <format>
  • supports <feature>
• Implement real decrypt: KAS rewrap + payload decryption, returning the original plaintext.
• Add a cli.sh / Makefile wrapper that the xtest harness can invoke.
• Verify round-trip interoperability locally:
  • Encrypt with otdfctl / Go SDK, decrypt with Swift.
  • Encrypt with Swift, decrypt with otdfctl / Go SDK.
• Add Swift to the xtest matrix/configuration in this repository.
• Document how to run the Swift xtests in the repo README or xtest docs.

Related

• OpenTDFKit repo: https://github.com/arkavo-org/OpenTDFKit
• Existing stub: xtest/cli.swift