[CLDAPP-423] Add Encryption Validation

[daehan-temporal]

What was changed

Adds Cloud CLI support for namespace payload encryption validation (EVE):

temporal cloud namespace encryption-validation get|set|enable|disable

namespace create also accepts optional --encryption-validation-* flags. If any of those flags is set, --encryption-validation-mode is required.

• set replaces the whole nested spec. Omitted optional flags are sent as empty/false.
• enable turns validation on. Unconfigured namespaces get defaults (warn / encoding / binary/encrypted). Disabled namespaces are re-enabled and keep metadata/inspect. Already-warn or already-deny is left unchanged. --deny only applies when turning validation on.
• disable sets mode to disabled and keeps metadata/inspect.

Bumps go.temporal.io/cloud-sdk to v0.20.0, which includes EncryptionValidation and defaults to Cloud API v0.23.0.

Why?

Give customers a CLI to inspect and change namespace encryption-validation settings, with enable/disable for the common on/off path and set as an explicit replace.

Checklist

1. Closes - CLDAPP-423

2. How was this tested:

go test ./temporalcloudcli -run 'TestCreateNamespace_|TestNamespaceDescription|TestNamespaceEncryptionValidation'

3. Any docs updates needed?
   https://docs.temporal.io/cli/command-reference/cloud/namespace

---

Note

Medium Risk
Changes namespace security policy (warn/deny can affect workflow acceptance) via full-spec replace on set; mistakes or omitted flags could misconfigure production namespaces.

Overview
Adds Temporal Cloud CLI support for namespace payload encryption validation, bumping go.temporal.io/cloud-sdk to v0.20.0.

New command group temporal cloud namespace encryption-validation with get, set, enable, and disable. get prints the current EncryptionValidationSpec; set fully replaces the nested spec (omitted optional flags become empty/false); enable applies defaults when unconfigured (warn, encoding, binary/encrypted), re-enables from disabled while keeping metadata/inspect, and leaves existing warn/deny unchanged (optional --deny); disable sets mode to disabled and preserves other fields. Mutations follow the usual get → prompt → UpdateNamespace + async polling pattern.

namespace create gains optional --encryption-validation-* flags wired through CreateNamespaceParams; if any encryption-validation flag is set, --encryption-validation-mode is required. Command definitions and tests cover create and the new subcommands; a protoutils golden file picks up the new spec field.

^{Reviewed by Cursor Bugbot for commit eb3778d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8dd25b5. Configure here.}