feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication

G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3:
- ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only
  (bodies never re-encrypted; revision/timestamps preserved -> invisible to
  cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed
  wraps; DEK zeroed on all paths.
- ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek):
  updates only the 4 wrap columns + kek_id, compare-and-swap on the current
  wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a
  review-caught TOCTOU).
- KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl.
  tombstones, idempotent/resumable skip-already-current, bounded CAS-retry,
  fail-closed on unknown/identical KEK.
- `secret rewrap-all` CLI verb: key material only via env-var name / file path,
  JSON counts report; README section + operator runbook.

Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end
CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed).

G-7 (clustered replication) — designed + planned, no code:
- Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka
  replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc +
  executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*.

Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/SecretCommands.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Rotation;
 
 namespace ZB.MOM.WW.Secrets.Cli;
 
@@ -156,6 +157,47 @@ public sealed class SecretCommands
         return removed ? 0 : 1;
     }
 
+    /// <summary>
+    /// rewrap-all: rotates the master KEK by re-wrapping every row's DEK from <paramref name="oldKek"/>
+    /// onto <paramref name="newKek"/> — bodies are never re-encrypted and no plaintext is exposed.
+    /// Prints a JSON report of the counts (total / rewrapped / already-current) and NEVER any key
+    /// material. Idempotent + resumable; fails closed (non-zero) on an identical-KEK mistake or a row
+    /// wrapped by an unrecognized KEK.
+    /// </summary>
+    /// <param name="oldKek">The provider for the KEK rows are currently wrapped under.</param>
+    /// <param name="newKek">The provider for the KEK rows should be re-wrapped onto.</param>
+    /// <param name="ct">A token to cancel the operation.</param>
+    /// <returns>0 on success; non-zero if the rotation was rejected or aborted.</returns>
+    public async Task<int> RewrapAllAsync(
+        IMasterKeyProvider oldKek, IMasterKeyProvider newKek, CancellationToken ct)
+    {
+        var service = new KekRotationService(_store, _cipher);
+        try
+        {
+            RewrapReport report = await service.RewrapAllAsync(oldKek, newKek, ct).ConfigureAwait(false);
+            WriteJson(new
+            {
+                action = "rewrap-all",
+                total = report.Total,
+                rewrapped = report.Rewrapped,
+                alreadyCurrent = report.AlreadyCurrent,
+            });
+            return 0;
+        }
+        catch (ArgumentException ex)
+        {
+            // Identical old/new KEK ids — nothing to rotate.
+            WriteJson(new { action = "rewrap-all", error = ex.Message });
+            return 1;
+        }
+        catch (SecretDecryptionException ex)
+        {
+            // A row on an unrecognized KEK aborted the pass, or a DEK failed to unwrap.
+            WriteJson(new { action = "rewrap-all", error = ex.Message });
+            return 1;
+        }
+    }
+
     /// <summary>Seals a value under the cipher and upserts it, carrying description + actor stamps.</summary>
     private async Task UpsertSealedAsync(
         SecretName name, string value, SecretContentType contentType, string? description, string? actor, CancellationToken ct)