feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication

G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3:
- ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only
  (bodies never re-encrypted; revision/timestamps preserved -> invisible to
  cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed
  wraps; DEK zeroed on all paths.
- ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek):
  updates only the 4 wrap columns + kek_id, compare-and-swap on the current
  wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a
  review-caught TOCTOU).
- KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl.
  tombstones, idempotent/resumable skip-already-current, bounded CAS-retry,
  fail-closed on unknown/identical KEK.
- `secret rewrap-all` CLI verb: key material only via env-var name / file path,
  JSON counts report; README section + operator runbook.

Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end
CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed).

G-7 (clustered replication) — designed + planned, no code:
- Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka
  replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc +
  executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*.

Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SecretCommandsTests.cs

@@ -19,6 +19,7 @@ public sealed class SecretCommandsTests : IAsyncLifetime, IDisposable
 
     private readonly SecretsSqliteConnectionFactory _factory;
     private readonly SqliteSecretStore _store;
+    private readonly FakeMasterKeyProvider _oldKek = new("kek-cli");
     private readonly AesGcmEnvelopeCipher _cipher;
     private readonly DefaultSecretResolver _resolver;
 
@@ -26,7 +27,7 @@ public sealed class SecretCommandsTests : IAsyncLifetime, IDisposable
     {
         _factory = new SecretsSqliteConnectionFactory(_dbPath);
         _store = new SqliteSecretStore(_factory);
-        _cipher = new AesGcmEnvelopeCipher(new FakeMasterKeyProvider("kek-cli"));
+        _cipher = new AesGcmEnvelopeCipher(_oldKek);
         // A near-zero TTL keeps the resolver from serving a stale plaintext across a rotate/remove.
         _resolver = new DefaultSecretResolver(
             _store, _cipher, NoOpAuditWriter.Instance, TimeSpan.Zero);
@@ -53,6 +54,45 @@ public sealed class SecretCommandsTests : IAsyncLifetime, IDisposable
 
     private static CancellationToken Ct => CancellationToken.None;
 
+    [Fact]
+    public async Task RewrapAll_MigratesRowsToNewKek_ReportsCountsWithoutLeakingValues()
+    {
+        var (seed, _) = NewSut();
+        await seed.SetAsync("sql/a", "value-a", SecretContentType.Text, null, "alice", Ct);
+        await seed.SetAsync("sql/b", "value-b", SecretContentType.Text, null, "alice", Ct);
+
+        var newKek = new FakeMasterKeyProvider("kek-new");
+        var (cmd, output) = NewSut();
+        int rc = await cmd.RewrapAllAsync(_oldKek, newKek, Ct);
+
+        Assert.Equal(0, rc);
+        string outStr = output.ToString();
+        Assert.Contains("\"action\":\"rewrap-all\"", outStr);
+        Assert.Contains("\"total\":2", outStr);
+        Assert.Contains("\"rewrapped\":2", outStr);
+        Assert.Contains("\"alreadyCurrent\":0", outStr);
+        // The report carries counts only — never a secret value.
+        Assert.DoesNotContain("value-a", outStr);
+        Assert.DoesNotContain("value-b", outStr);
+
+        // The rows now decrypt under the NEW KEK (proof the rewrap actually re-keyed them).
+        var newCipher = new AesGcmEnvelopeCipher(newKek);
+        Assert.Equal("value-a", newCipher.Decrypt((await _store.GetAsync(new SecretName("sql/a"), Ct))!));
+    }
+
+    [Fact]
+    public async Task RewrapAll_IdenticalKek_ReturnsErrorExitCode()
+    {
+        var (seed, _) = NewSut();
+        await seed.SetAsync("sql/a", "value-a", SecretContentType.Text, null, "alice", Ct);
+
+        var (cmd, output) = NewSut();
+        int rc = await cmd.RewrapAllAsync(_oldKek, new FakeMasterKeyProvider("kek-cli"), Ct);
+
+        Assert.Equal(1, rc);
+        Assert.Contains("\"error\"", output.ToString());
+    }
+
     [Fact]
     public async Task Set_Then_Get_RoundTrips()
     {