Check whether this project still depends on the retiring signing key

Machine-readable rotation status. A project's anon_key/service_key are DERIVED from the platform signing key and carry no expiry, so they persist in .env files and CI indefinitely; that key is being retired. state is legacy while the project still relies on them and rotatable once it holds individually revocable credentials. There is deliberately NO deadline: retirement is gated on conditions (every tenant migrated, 30 consecutive days of zero legacy-key use, explicit operator approval), not a date — retirement.gated_on[] lists them and retirement.deadline is always null. Requires project.read rather than credential-manage: knowing you should rotate is not a privileged act, and gating it harder would hide the warning from the automation that needs it. The in-band counterpart is the X-Run402-Key-Rotation response header on owner-facing surfaces.