Background: The revised KEK design introduces a v2 WT_CRYPT_HEADER that appends a uint64_t timestamp at offset 16 (header_size = 24, compatible_version stays 1). This ticket defines the v2 format and populates WT_CRYPT_KEYS::timestamp when reading KEK pages. The existing reader already uses header_size to locate the payload, so no structural changes are needed for forward compat.

Changes:

• Add WT_CRYPT_HEADER_VERSION_2 = 0x2 and v2 layout to crypt_header.h
• Set crypt.timestamp from the header (version >= 2) or 0 (v1) before existing load_key and on_key_update call sites
• No behavior change for pull-based (version=0) key providers

Acceptance Criteria:

• v2 pages: WT_CRYPT_KEYS::timestamp populated correctly
• v1 pages: WT_CRYPT_KEYS::timestamp is 0
• Existing pull-based tests pass