S27: HPKE-Base content wrap + public-key directory; reject xor on send

Routing/error fields stay clear. Content is X25519-HKDF-SHA256-ChaCha20.

python/secure_messaging/__init__.py

@@ -5,6 +5,8 @@ from .error_bundle import NetworkErrorBundle  # system-key + sender-only
 from .admin_history import AdminHistory  # DataCube-shaped append-only config log
 from .npe_adapter import NpeRequired  # fail-closed NPE
 from .router import RouteResult, handle_send  # success/failure send policy
+from .pubkey_dir import PubKeyDir  # public-key directory
+from .content import wrap_content, unwrap_content, routing_view  # HPKE content
 
 __all__ = [
     "SignedConfig",
@@ -15,4 +17,8 @@ __all__ = [
     "NpeRequired",
     "RouteResult",
     "handle_send",
+    "PubKeyDir",
+    "wrap_content",
+    "unwrap_content",
+    "routing_view",
 ]