EQL v3 JSON: implement JSONPath selector-with-constraint querying (->, ->>)

[coderdan]

Context

#621 adds EQL v3 encrypted JSON (types.Json) with containment querying only — ops.contains(col, subObject) emitting the @> operator with a query_jsonb needle.

EQL v3 supports a second JSON query form that #621 does not implement: JSONPath selector with a constraint, e.g.

foo->'bar'  = $1
foo->'wee'  > $1

The eql_v3_json domain ships the operators for it — ->(text|int) and ->>(text|int) — and encryptQuery(value, { queryType: 'searchableJson' }) already auto-infers a selector term for string (JSONPath) needles. What's missing is the adapter surface: the v3 Drizzle operators expose no ->/->> selector, so a selector-with-constraint query can't be expressed, and there are no tests for it.

Proposed change

• Add selector operators (-> / ->>) to the v3 Drizzle integration for types.Json columns.
• Compose the extracted selector value with the existing comparison operators so col->'bar' = $1 / col->'wee' > $1 work end-to-end.
• Add a live oracle + tests (mirroring json-contains.integration.test.ts).
• Document the pattern in skills/stash-encryption / skills/stash-drizzle.

Notes

• Values returned by a selector should be usable in the other query forms depending on their type (equality, ordering, etc.).
• Scoped out of feat(stack): EQL v3 JSON support — types.Json + containment #621 to keep that PR to column + round-trip + containment.

https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

[coderdan]

Additional design note surfaced in #621: the typed client shares one plaintext type (PlaintextForColumn<Col>) between encrypt and encryptQuery. For a json column that's now JsonDocument (object/array/null). But a selector query needs a top-level string needle ('$.user.email'), which JsonDocument excludes. So selector support needs encryptQuery's json plaintext to differ from encrypt's (document for containment | string for selector) — encrypt must still reject a bare scalar. Factor that into the typing when implementing.