Create a dedicated CipherStash logger package for Stack; deprecate the legacy utils logger

[coderdan]

There are two logger lineages in the monorepo today:

• Legacy (packages/utils/logger/index.ts): plain console.*, [protect]
  prefix, PROTECT_LOG_LEVEL, API { debug, info, error }, no plaintext**
  **guard. It is not a package — @cipherstash/protect (13 files) and
  @cipherstash/nextjs (4 files) reach it via cross-package relative-path imports
  (../../../utils/logger).
• Stack (packages/stack/src/utils/logger/index.ts): evlog-based with
  sampling, STASH_STACK_LOG, API { debug, info, warn, error }, and a
  safeMessage guard that stringifies only the message arg and drops the rest so
  a stray logger.error('failed', encryptConfig) cannot leak
  config/plaintext (load-bearing for the "never log plaintext" guarantee).

Decision

Create a new dedicated CipherStash logger package (e.g. @cipherstash/logger)
housing Stack's evlog-based, plaintext-safe logger, and have the new Stack line
depend on it. The legacy packages/utils/logger stays with the predecessor
packages (@cipherstash/protect, @cipherstash/nextjs) and is deprecated and**
**removed once those sunset. We do NOT migrate the maintenance-mode legacy packages
onto the new logger, and we do NOT regress Stack onto the legacy console logger.

Scope (when picked up)

• New package with Stack's logger moved in verbatim (keep the safeMessage
  plaintext guard, evlog sampling, and env-var behaviour; decide whether the
  service name / env var stay stack-branded or become generic).
• @cipherstash/stack depends on it and re-exports as needed.
• The split adapter packages (Split the Drizzle and Supabase integrations into their own packages (stack-drizzle, stack-supabase) #627) consume it directly, so logger can be
  dropped from @cipherstash/stack/adapter-kit (where it currently sits as an
  interim — see feat(stack): adapter package split — foundation + plan (#627) #630).
• Leave packages/utils/logger and the protect/nextjs relative-path imports
  untouched; they retire with those packages.

Notes

• Interacts with the adapter split (Split the Drizzle and Supabase integrations into their own packages (stack-drizzle, stack-supabase) #627 / feat(stack): adapter package split — foundation + plan (#627) #630): until this lands, adapter-kit
  re-exports logger from Stack's internal logger as the interim seam.
• The legacy relative-path imports (../../../utils/logger) are a pre-existing
  hack; formalizing or removing them is part of the eventual legacy-package
  cleanup, not this issue.

Deferred follow-up — not blocking the 1.0 RC.