Workflow: rotate an agent key

List metadata with listApiKeys, then call rotateApiKey using idempotency. The successor preserves or narrows scopes and cannot expire later than the caller. Copy the one-time secret immediately, validate getCapabilities with it, update the secret store, then end overlap/revoke the old key.

Expected state: the replacement works, the old key is rejected after revocation, and no reusable secret exists in logs, docs, or idempotency storage.