docs(plans): replace option B targets with the plan builder design

The first draft kept the Go binding's value / record / probe split and added
a generic Target[O] so one EncryptAs could serve all three. Reviewing it
against the Cipher showed the split was the problem: a tree already seals
any value, and what a row needs beyond that is a context per field and
indexes per field. A plan is those two facts, saved as the tail of the
ordinary encrypt call so the write, the query and the read take one
declaration.

The doc now records the settled chain (context / fields / encrypt /
encrypt_index / passthrough / using / query, .await as finalizer), how each
builder call lowers to the existing Encryption combinators, the three engine
additions (passthrough(), execute-by-value, Index<S> / Indexes<S>), and the
consolidation: the derive emits the builder and dynamic::record becomes a
lowering into it, so Rust, the derive, the guest and Go produce the same
bytes by construction. The Go mirror follows the same chain with Run(ctx)
as the finalizer.

Refs #1046

Author: coderdan