feat(durable): add zeph durable rotate-key for AEAD payload key rotation

[bug-ops]

Summary

• Issue wire durable high-water-mark key rotation (with_previous_hwm_key) into --init/a CLI command #6447 originally described operational tooling for a high-water-mark key-rotation primitive credited to research(security): persisted transcript/history integrity — no tamper detection before durable replay #6360. That primitive does not exist in the codebase (with_hwm_key/with_previous_hwm_key/HWM_KEY_EPOCH/DurableError::HighWaterMarkIntegrity — zero matches) and research(security): persisted transcript/history integrity — no tamper detection before durable replay #6360 is an unimplemented, open research(security) issue with no closing PRs. This PR rescopes wire durable high-water-mark key rotation (with_previous_hwm_key) into --init/a CLI command #6447 to the real analogous gap it also described: XChaCha20Poly1305Cipher::with_previous existed but was never operationally wired.
• Adds zeph durable rotate-key to open/close a rotation window for the durable execution layer's AEAD payload key (ZEPH_DURABLE_KEY). [durable] gains config-driven key_id/previous_key_id (no more recompile to rotate). load_durable_cipher — the single chokepoint shared by the agent write path, scheduler-daemon write path, and CLI/--reveal read path — now builds the cipher from both fields and hard-errors if previous_key_id is set but the vault secret is missing.
• Design went through 2 adversarial critique rounds before implementation: caught that vault-first write ordering (originally proposed) silently mis-decrypts every pre-rotation payload on a crash, and that a second rotation while a window is open would silently orphan the first previous key's blobs. Shipped design: config-first-then-vault write order + partial-state detector, refuse-a-second-window guard, shared-DB acknowledgment gate (--ack-shared-db-drain), and a default-on blob-scan before --drop-previous discards the previous key (--force to skip, scoped only to that path).
• A post-implementation critique and independent tester pass both independently found the same coverage gap (the fail-closed branch was untested at the layer every normal zeph run/resume actually calls through, not just the CLI's own guard) — closed with a follow-up round of tests before review.
• zeph --init's existing key-replacement wizard step is unchanged in behavior but now labels itself a destructive reset with no rotation window, pointing operators to rotate-key for the safe alternative.
• HMAC rotation windows on shared databases and a TUI passive rotation indicator are explicitly out of scope, filed as follow-ups: durable: TUI passive indicator for rotate-key window (key_id / rotation-window-open) #6450, durable: control-entry HMAC has no rotation window on shared DBs (with_previous_hmac_key) #6451.

Closes #6447

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (14418 passed, 35 skipped)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• gitleaks protect --staged --no-banner --redact
• 15 new tests in src/commands/durable.rs (guard sequence, fail-closed branch at the bootstrap layer, round-trip through the real CLI+backend, R5 error-mapping end-to-end) + unit/doc-test coverage across zeph-config, zeph-core, zeph-durable
• Independent security audit (0 critical/high/medium) and performance review (clean, non-hot-path) — see PR discussion for handoff references
• .local/testing/playbooks/durable-key-rotation.md and .local/testing/coverage-status.md updated
• Live CLI smoke test against a real vault+config (recommended as the next CI cycle's live-session scenario — see playbook Scenario 4)