Rotate Principal Agent Key

Mint a replacement key and return it exactly once.

The old key stops working the moment this commits -- there is no grace window, because a rotation people reach for after a leak is worthless if the leaked key keeps working. That makes this destructive in the way that matters, so the response says so and the UI must confirm before calling it.