feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication

G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3:
- ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only
  (bodies never re-encrypted; revision/timestamps preserved -> invisible to
  cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed
  wraps; DEK zeroed on all paths.
- ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek):
  updates only the 4 wrap columns + kek_id, compare-and-swap on the current
  wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a
  review-caught TOCTOU).
- KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl.
  tombstones, idempotent/resumable skip-already-current, bounded CAS-retry,
  fail-closed on unknown/identical KEK.
- `secret rewrap-all` CLI verb: key material only via env-var name / file path,
  JSON counts report; README section + operator runbook.

Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end
CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed).

G-7 (clustered replication) — designed + planned, no code:
- Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka
  replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc +
  executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*.

Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.

ZB.MOM.WW.Secrets/README.md

@@ -12,7 +12,7 @@ plaintext back on demand — from application code, from configuration, or from
 | `ZB.MOM.WW.Secrets` | Implementation: AES-256-GCM envelope cipher, env/file/DPAPI master-key providers, SQLite store, TTL resolver (audited), `${secret:}` config expander, `AddZbSecrets`. |
 | `ZB.MOM.WW.Secrets.Ui` | Blazor RCL on `ZB.MOM.WW.Theme`: list / add / rotate / delete + policy-gated, audited reveal. |
 
-A `secret` CLI (`set` / `get` / `list` / `rm` / `rotate`) ships in the repo (not packed).
+A `secret` CLI (`set` / `get` / `list` / `rm` / `rotate` / `rewrap-all`) ships in the repo (not packed).
 
 ## How it protects secrets
 
@@ -50,6 +50,24 @@ await expander.ExpandConfigurationAsync((IConfigurationRoot)builder.Configuratio
 The master key is 32 bytes, provided base64 in `ZB_SECRETS_MASTER_KEY` (Environment source).
 A missing/invalid key fails closed at startup (`MasterKeyUnavailableException`).
 
+## Rotating the master KEK
+
+Because each row is a body sealed under a per-secret DEK that is *wrapped* by the KEK, rotating
+the master key only re-wraps DEKs — bodies are never re-encrypted and no value history changes.
+The `secret rewrap-all` CLI verb (backed by `KekRotationService`) migrates every row from the
+old KEK to the new one; it is idempotent and safe to re-run:
+
+```bash
+# New KEK defaults to the configured Secrets:MasterKey; supply the OLD key by env-var name or path.
+ZB_SECRETS_MASTER_KEY=<new-base64>  ZB_SECRETS_OLD_KEY=<old-base64> \
+  secret rewrap-all --old-key-env ZB_SECRETS_OLD_KEY
+# → {"action":"rewrap-all","total":N,"rewrapped":N,"alreadyCurrent":0}
+```
+
+Run it with resolve traffic quiesced and once per independent store (once for a shared
+SQL-Server store; once per node for per-node SQLite on a shared KEK). See the operator runbook:
+[`docs/operations/kek-rotation.md`](docs/operations/kek-rotation.md).
+
 ## Runtime + human access
 
 - **App code:** inject `ISecretResolver` and call `GetAsync(name, ct)`. Every resolve is