feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication

G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3:
- ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only
  (bodies never re-encrypted; revision/timestamps preserved -> invisible to
  cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed
  wraps; DEK zeroed on all paths.
- ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek):
  updates only the 4 wrap columns + kek_id, compare-and-swap on the current
  wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a
  review-caught TOCTOU).
- KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl.
  tombstones, idempotent/resumable skip-already-current, bounded CAS-retry,
  fail-closed on unknown/identical KEK.
- `secret rewrap-all` CLI verb: key material only via env-var name / file path,
  JSON counts report; README section + operator runbook.

Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end
CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed).

G-7 (clustered replication) — designed + planned, no code:
- Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka
  replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc +
  executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*.

Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Crypto/AesGcmEnvelopeCipherTests.cs

@@ -95,6 +95,97 @@ public class AesGcmEnvelopeCipherTests
         Assert.Contains("unknown KEK", ex.Message, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void Rewrap_RewrapsDek_BodyStillDecryptsUnderNewKek()
+    {
+        var oldKek = new FakeMasterKeyProvider("kek-old");
+        var newKek = new FakeMasterKeyProvider("kek-new");
+        var oldCipher = new AesGcmEnvelopeCipher(oldKek);
+        var name = new SecretName("sql/foo");
+
+        StoredSecret row = oldCipher.Encrypt(name, "hunter2", SecretContentType.Text);
+        Assert.Equal("kek-old", row.KekId);
+
+        // Rewrap is provider-explicit — it can be driven through any cipher instance.
+        StoredSecret rewrapped = oldCipher.Rewrap(row, oldKek, newKek);
+
+        Assert.Equal("kek-new", rewrapped.KekId);
+        // The DEK-sealed body is untouched; only the KEK-wrap envelope changed.
+        Assert.True(rewrapped.Ciphertext.AsSpan().SequenceEqual(row.Ciphertext));
+        Assert.True(rewrapped.Nonce.AsSpan().SequenceEqual(row.Nonce));
+        Assert.True(rewrapped.Tag.AsSpan().SequenceEqual(row.Tag));
+        Assert.False(rewrapped.WrappedDek.AsSpan().SequenceEqual(row.WrappedDek));
+
+        // The rewrapped row decrypts under the NEW KEK...
+        var newCipher = new AesGcmEnvelopeCipher(newKek);
+        Assert.Equal("hunter2", newCipher.Decrypt(rewrapped));
+        // ...and no longer under the OLD KEK (kek_id now names the new KEK; old cipher fails closed).
+        Assert.Throws<SecretDecryptionException>(() => oldCipher.Decrypt(rewrapped));
+    }
+
+    [Fact]
+    public void Rewrap_PreservesRevisionTimestampsTombstoneAndMetadata()
+    {
+        var oldKek = new FakeMasterKeyProvider("kek-old");
+        var newKek = new FakeMasterKeyProvider("kek-new");
+        var cipher = new AesGcmEnvelopeCipher(oldKek);
+
+        StoredSecret row = cipher.Encrypt(new SecretName("sql/foo"), "hunter2", SecretContentType.Text) with
+        {
+            Revision = 7,
+            IsDeleted = true,
+            DeletedUtc = DateTimeOffset.UnixEpoch,
+            CreatedUtc = DateTimeOffset.UnixEpoch,
+            UpdatedUtc = DateTimeOffset.UnixEpoch.AddMinutes(5),
+            CreatedBy = "alice",
+            UpdatedBy = "bob",
+            Description = "the foo password",
+        };
+
+        StoredSecret rewrapped = cipher.Rewrap(row, oldKek, newKek);
+
+        // Only the wrap envelope + kek_id change — a rewrap must be invisible to (updated_utc, revision) LWW.
+        Assert.Equal(7, rewrapped.Revision);
+        Assert.True(rewrapped.IsDeleted);
+        Assert.Equal(row.DeletedUtc, rewrapped.DeletedUtc);
+        Assert.Equal(row.CreatedUtc, rewrapped.CreatedUtc);
+        Assert.Equal(row.UpdatedUtc, rewrapped.UpdatedUtc);
+        Assert.Equal("alice", rewrapped.CreatedBy);
+        Assert.Equal("bob", rewrapped.UpdatedBy);
+        Assert.Equal("the foo password", rewrapped.Description);
+        Assert.Equal(SecretContentType.Text, rewrapped.ContentType);
+    }
+
+    [Fact]
+    public void Rewrap_WrongOldKekId_FailsClosed()
+    {
+        var actualKek = new FakeMasterKeyProvider("kek-old");
+        var wrongOld = new FakeMasterKeyProvider("kek-somethingelse");
+        var newKek = new FakeMasterKeyProvider("kek-new");
+        var cipher = new AesGcmEnvelopeCipher(actualKek);
+
+        StoredSecret row = cipher.Encrypt(new SecretName("sql/foo"), "hunter2", SecretContentType.Text);
+
+        // Row is wrapped by "kek-old" but the caller claims the old KEK is "kek-somethingelse".
+        var ex = Assert.Throws<SecretDecryptionException>(() => cipher.Rewrap(row, wrongOld, newKek));
+        Assert.Contains("kek-old", ex.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Rewrap_CorrectKekIdButWrongKeyMaterial_FailsClosed()
+    {
+        // Same KEK-id string, different key bytes → the unwrap must fail closed (tag mismatch),
+        // never emitting a garbage DEK.
+        var realOld = new FakeMasterKeyProvider("kek-old");
+        var imposterOld = new FakeMasterKeyProvider("kek-old"); // same id, fresh random bytes
+        var newKek = new FakeMasterKeyProvider("kek-new");
+        var cipher = new AesGcmEnvelopeCipher(realOld);
+
+        StoredSecret row = cipher.Encrypt(new SecretName("sql/foo"), "hunter2", SecretContentType.Text);
+
+        Assert.Throws<SecretDecryptionException>(() => cipher.Rewrap(row, imposterOld, newKek));
+    }
+
     private static bool Contains(byte[] haystack, byte[] needle)
     {
         if (needle.Length == 0 || haystack.Length < needle.Length)