fix(secrets-cli): doctor flow — catch scoped exactly to the rewrap call

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/Interactive/Flows/KekDoctorFlow.cs

@@ -108,8 +108,8 @@ public sealed class KekDoctorFlow : IInteractiveFlow
     {
         IMasterKeyProvider oldKek = PromptForOldKek(console);
 
-        try
+        // Prompt and confirm OUTSIDE the guard: only the rewrap call itself is caught, so a stray
-        {
+        // ArgumentException from setup/prompt code is never mis-reported as a "rewrap failed" message.
         string oldKekId = oldKek.KekId;
         int moving = report.Rows.Count(r => string.Equals(r.RowKekId, oldKekId, StringComparison.Ordinal));
 
@@ -122,21 +122,27 @@ public sealed class KekDoctorFlow : IInteractiveFlow
             return;
         }
 
-            RewrapReport result = await doctor.RewrapAllAsync(session, oldKek, ct).ConfigureAwait(false);
+        RewrapReport result;
-            console.MarkupLineInterpolated(
+        try
-                $"[green]Re-wrapped {result.Rewrapped} row(s)[/] onto the session KEK ({result.AlreadyCurrent} already current) of {result.Total} total.");
+        {
+            result = await doctor.RewrapAllAsync(session, oldKek, ct).ConfigureAwait(false);
         }
         catch (ArgumentException ex)
         {
             // Old and session KEK are identical — nothing to rotate.
             console.MarkupLineInterpolated($"[red]Rewrap failed:[/] {ex.Message}");
+            return;
         }
         catch (SecretDecryptionException ex)
         {
             // Wrong old key, or a row wrapped by neither the old nor the session KEK (the pass aborted;
             // any rows re-wrapped before the anomaly stay persisted).
             console.MarkupLineInterpolated($"[red]Rewrap failed:[/] {ex.Message}");
+            return;
         }
+
+        console.MarkupLineInterpolated(
+            $"[green]Re-wrapped {result.Rewrapped} row(s)[/] onto the session KEK ({result.AlreadyCurrent} already current) of {result.Total} total.");
     }
 
     // Prompts for the old-KEK source and builds the matching provider. Paste feeds a masked base64 entry to