Changes to Admin (DepositAddressMigrate): retire a user's HEALTHY, KEK-sealed deposit address in favour of one minted inside the key custodian's enclave (phase 4 of docs/MIGRATION-turnkey.md), and refresh the hub's address cache.