fix(dstack-util): fail closed when an encrypted env cannot be decrypted

[kvinwang]

The local, tpm and none key providers hand out no env crypt key, and decrypt_env_vars treated that like "no encrypted env": a present .encrypted-env was dropped and the app booted with none of its secrets. It now fails closed.

The VMM only writes .encrypted-env after fetching the app's encrypt pubkey from a KMS, so the newly failing combination was already losing every secret.

Docs (cvm-boundaries.md):

• an empty key_provider_id pins nothing; the provider identity is still in the key-provider launch event;
• the env envelope is keyed by the app ID alone, so the host can withhold or replay an earlier ciphertext — apps should carry a version or expiry in the plaintext.

Split out of #1243. Conflicts trivially with #1233 around write_env_file.