- Use encryption version 1 (no PKCS7 padding) for outgoing messages
- Support decrypting both version 0 (with PKCS7) and version 1
- Add --encrypt flag to interop_test for encrypted testing
- Add test_interop_encrypted.sh for encrypted interop testing

Verified: OCaml SWIM ↔ Go memberlist encrypted ping/ack works.

- Refactor encode/decode functions to use Cstruct buffers directly
- Add *_to_cstruct and *_from_cstruct variants for all codec functions
- Fix compound message encoding bug: create fresh buffer per message
- Add backward-compatible string wrappers for tests

All tests pass including codec roundtrip property tests and Go interop.

- Add interop/main.go: Go memberlist server for testing
- Add bin/debug_*.ml: OCaml debug tools for codec/ping testing
- Add test_interop.sh: script to run interop test
- Update .gitignore for compiled binaries

- Add conditional encryption based on config.encryption_enabled
- Fix Ping message: node field now set to target (memberlist requirement)
- Add Wire submodule with memberlist-compatible msgpack types
- Update codec to use msgpck for proper msgpack encoding
- Use AES-128-GCM with 16-byte keys (memberlist compatible)
- Add interop test client for testing against Go memberlist

Verified: OCaml SWIM can send pings to Go memberlist and receive acks.
Tracked in swim-7wx (encryption format still needs work).

- test_kcas.ml: 15 tests for buffer_pool, membership, pending_acks, member transitions
- test_integration.ml: 9 cluster lifecycle tests (create, start, shutdown, stats, members, broadcast)
- Fix env type constraint to accept platform-specific Eio backends via identity cast

Total test count: 89 tests across 6 test executables