repo-create: split --encryption into --encryption + --id-hash (#9168)

[ThomasWaldmann]

Resolves #9168.

What

borg repo-create --encryption packed two orthogonal dimensions — the cipher / AE algorithm and the id hash function — into a single combined string (e.g. blake3-chacha20-poly1305), which grows combinatorially as ciphers/hashes are added. Key location was already split out into --key-location. This finishes the decomposition:

• --encryption / -e (required): cipher / AE algorithm — none, authenticated, aes256-ocb, chacha20-poly1305
• --id-hash / -i (default sha256): id hash function — sha256 or blake3
• --key-location (unchanged): repokey (default) or keyfile

Example:

borg repo-create --encryption aes256-ocb --id-hash blake3 --key-location keyfile

Notes / decisions

• Clean break: the old combined --encryption names are removed. Select a BLAKE3 suite via --encryption ... --id-hash blake3 instead of blake3-*. Borg 2 is unreleased, so no deprecation shim.
• aes-ocb renamed to aes256-ocb for clarity. The key NAME shown by borg repo-info (AES256-OCB) and the ARG_NAME reported in --json (encryption.mode) were updated to match.
• none (plaintext) has no key, so it only supports the sha256 id hash; --encryption none --id-hash blake3 is rejected with a clear error.

Implementation

No on-disk format, key-type byte, or crypto behavior changes — the 7 existing key classes already form a clean cross-product of {cipher} × {id-hash}. Selection is now driven by two new class attributes, ENC_NAME and IDHASH_NAME (the latter set once on the id-hash mix-ins), and key_creator() matches on the pair.

Tests / docs

• Added cross-product resolution tests plus rejection tests (none+blake3, legacy combined name) in repo_create_cmd_test.py; updated test constants and the few blake3-aes-ocb literals.
• Regenerated docs/usage/repo-create.rst.inc, rewrote the epilog (table → three-axis explanation), updated transfer.rst, and added a changes.rst entry.

Full archiver + crypto + benchmark suites pass locally.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.88%. Comparing base (9ba7241) to head (2eef6c8).
⚠️ Report is 12 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #9779   +/-   ##
=======================================
  Coverage   84.87%   84.88%           
=======================================
  Files          92       92           
  Lines       15165    15172    +7     
  Branches     2271     2275    +4     
=======================================
+ Hits        12872    12879    +7     
  Misses       1589     1589           
  Partials      704      704           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.