stack-encrypt: store short TextMatch text as an empty filter, refuse only short queries #1185

Background

A TextMatch value shorter than one n-gram (under three characters with the EQL v4 defaults) has no tokens. stack-encrypt's match_term refuses token-less text on both sides, stored and queried, so one short value fails a whole row insert. This came up in the review of #1164 and is a checkbox on #1178.

Problem

A two-letter name or an empty string cannot be stored in a TextMatch column at all, although it is a valid value that no needle could match.

Proposal

• A stored match term of token-less text is the empty filter (bf: []), which no query matches.
• A query of token-less text is still refused, before a term exists, because an empty query would match every row.
• The split relies on the query term being its own type (MatchQuery, from stack-encrypt: name the operator, not the index, in a query (Eq and Matches) #1182), so the stored and query paths can differ.
• A stack-encrypt release, so eql-bindings can store short TextMatch text and the Go SDK can stop refusing it.
• Tests: a short value stores and decrypts, no query finds it, and a short query is refused.

Related

• Depends on stack-encrypt: name the operator, not the index, in a query (Eq and Matches) #1182.
• feat(eql-bindings): produce EQL v4 TextMatch from Stack Encrypt match terms #1164, Produce EQL v4 TextMatch from Stack Encrypt's match terms #1181: the TextMatch work that refuses short text today.
• Tracking: implement ADR-0009, operator-typed query terms for Stack Encrypt #1178: tracks ADR-0009.