Rename a subgroup by rewriting subgroup_key on every active item in (category, subgroup_key) to new_subgroup_key. Each touched item is flagged manual_override=True, and any subgroup-scoped query threads on the old key are carried over so their open-query badge follows the rename.

Rejected (400) for the salaries bucket — its keys are synthesised per employee identity. Rejected (409) if the new name already exists in the category, to avoid a rename silently becoming a merge.