A sealed value names the key that sealed it, so secret.key can rotate and open still reads the old one #11472

Intent: docs/ORIGINS.md says "Key rotation is not built"; losing or replacing secret.key today means reconnecting every origin.

Done:

• [x] seal writes v2:<keyid>:<iv>:<ciphertext> where keyid is the first 8 hex of the key's SHA-256; open still reads v1: values with the current key.
• [x] loadKey can hold a current key and a previous one (secret.key and secret.key.old, both 0600, both under the data dir); open tries the key the value names.
• [x] A test: a value sealed under key A opens after key B becomes current while A is kept as old, and is bad_key once A is gone; a v1 value from before still opens.
• [x] The docs/ORIGINS.md line is replaced by how rotation works; plaintext is never logged or thrown.

Files: src/kernel/secret.ts, test/secret-store.test.ts, docs/ORIGINS.md Risks: a wrong format change strands every sealed token: v1 must keep opening Brief: a Trust builder (mason or torque). A person assigns. Every behaviour added has a test that fails without it; bun test passes; touching src/web runs bun scripts/design-lint.ts.

Reviewed pull #11488 at its head: ticked seal writes v2:<keyid>:<iv>:<ciphertext> where keyid is the first 8 hex of the key's SHA-256; open still reads v1: values with the current key.; loadKey can hold a current key and a previous one (secret.key and secret.key.old, both 0600, both under the data dir); open tries the key the value names.; A test: a value sealed under key A opens after key B becomes current while A is kept as old, and is bad_key once A is gone; a v1 value from before still opens.; The docs/ORIGINS.md line is replaced by how rotation works; plaintext is never logged or thrown..