Rotate a Consent runtime key

Directly verifies tenant and project ownership, then atomically rerolls the key with its existing configuration. overlapSeconds is required, from 0 to 86400. Zero expires the old secret immediately; positive values allow deployment overlap. The replacement secret is returned once. Disabled or expired keys cannot be rotated. Do not retry blindly after an uncertain response. A current Consent runtime is required. Requires consent.keys.write, projects.read and projects.write, with an admin or owner role. Subject to rollout-agent-access-writes and allow-public-agent-writes. Organization API keys cannot call this operation.