Finish xtest CLI for cross-SDK interoperability

## Goal

Add the OpenTDFKit Swift SDK to the `opentdf-tests` cross-SDK compatibility matrix so that Swift-produced TDFs can be decrypted by the reference SDKs (and vice versa).

## Background

- OpenTDFKit is a Swift implementation of OpenTDF supporting both NanoTDF and TDF (Archive Envelope) formats.
- The upstream `opentdf/tests` repository runs xtests across the official SDKs to ensure interoperability.
- This fork exists to add Swift coverage and drive the required CLI/API changes in OpenTDFKit.

## Current State

The OpenTDFKit repo has a partial `xtest/cli.swift` stub, but it is not yet functional for cross-SDK testing:

- ZTDF / `ztdf-ecwrap` encrypt and decrypt are not implemented (they `exit(1)`).
- NanoTDF decrypt only parses the header and writes a placeholder; it does not recover plaintext via KAS rewrap.
- The CLI interface and environment-variable contract need to match what the xtest harness expects.

## Acceptance Criteria

- [ ] Finish the Swift xtest CLI in OpenTDFKit so it supports:
- `encrypt <ciphertext> nano`
- `encrypt <plaintext> <ciphertext> nano-with-ecdsa`
- `encrypt <plaintext> <ciphertext> ztdf`
- `encrypt <plaintext> <ciphertext> ztdf-ecwrap`
- `decrypt <ciphertext> <recovered> <format>`
- `supports <feature>`
- [ ] Implement real decrypt: KAS rewrap + payload decryption, returning the original plaintext.
- [ ] Add a `cli.sh` / Makefile wrapper that the xtest harness can invoke.
- [ ] Verify round-trip interoperability locally:
- Encrypt with `otdfctl` / Go SDK, decrypt with Swift.
- Encrypt with Swift, decrypt with `otdfctl` / Go SDK.
- [ ] Add Swift to the xtest matrix/configuration in this repository.
- [ ] Document how to run the Swift xtests in the repo README or xtest docs.

## Related

- OpenTDFKit repo: https://github.com/arkavo-org/OpenTDFKit
- Existing stub: `xtest/cli.swift`

Start with the partial xtest/cli.swift stub and compare its interface with the xtest harness contract. Then inspect the planned cli.sh or Makefile wrapper and the README or xtest documentation requirements. Done means all listed encrypt, decrypt, and supports commands work, Swift is in the matrix, and both cross-SDK round trips pass locally.

Written by the indexing model from the issue text.