Use one-shot AES-CBC for closed PKCS7 encryption

Replace one temporary encryptor and adjacent full-array TransformFinalBlock call after explicit Key/IV/CBC/PKCS7 settings on an Aes.Create local. Preserve the Length null failure and original data/settings; require one transform use and no cipher escapes. Skip other providers/modes/padding, decryption, stateful transforms, captures/ref/unsafe/async and conditional snapshots. Opt-in modern API port, no algorithm strengthening.