feature: build key-rotation runbook and tooling for disclosure VK and pool admin rotation

[tech-adrian]

Problem

contracts/pool/src/lib.rs supports admin rotation and contracts/compliance/src/lib.rs supports disclosure-VK rotation, but there's no documented runbook or scripted tooling for actually performing a rotation safely (e.g. under a suspected key-compromise incident), separate from the admin-dashboard UI proposed elsewhere in this batch.

Why it matters

Key rotation is the kind of operation that needs to be rehearsed and scripted ahead of time — figuring out the correct sequence of calls during an actual incident is exactly when mistakes happen.

Scope

• New scripts/rotate-admin.sh and scripts/rotate-disclosure-vk.sh performing the rotation via Stellar CLI, mirroring the style of existing scripts/demo.sh/scripts/demo-compliance.sh.
• New docs/RUNBOOK_KEY_ROTATION.md documenting pre-checks, the rotation sequence, and post-rotation verification steps.
• Contract test additions in contracts/pool and contracts/compliance explicitly covering the "old key immediately invalid after rotation" property.
• Link the runbook from README.md.

Acceptance criteria

• Running the scripts against a local/testnet deployment successfully rotates the admin/VK and the runbook accurately describes every step needed.