V3 deterministic file-encryption capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local age CLI encrypts one source file to one recipient via the file.encrypt_age catalog operation. This pack deliberately exposes encrypt-only recipient mode: no decrypt, no identity files, no passphrase prompts, no recipient files, and no arbitrary flags. Fixed-function and reproducible: the executor materializes the source file and owns the throwaway output directory, while age writes a fixed armored encrypted.age result captured as result.file_ref. Requires age on PATH (Debian/Ubuntu: apt install age; macOS: brew install age). Local and no-egress.