[Spec 030] Implement deterministic signing-key rotation gates

[XnLemon]

Parent

#75 (#75)

Depends on

• [Spec 030] Resolve signing-key rotation policy and ADR #76 ([Spec 030] Resolve signing-key rotation policy and ADR #76)
• [Spec 030] Freeze rotation contracts and audit boundary #77 ([Spec 030] Freeze rotation contracts and audit boundary #77)
• PR [codex] add public Agent share URLs #74 merged into main

Goal

Implement the approved deterministic Router credential key lifecycle for one explicit trust domain.

Scope

• Prepare a replacement key without issuing with it.
• Block activation when any declared Agent verifier or Router signer is stale, unavailable, or outside scope.
• Activate exactly one explicit signer per Router instance and expose convergence evidence.
• Enforce the approved credential drain boundary before old-key retirement.
• Support only the approved manual rollback and emergency compromise actions.
• Select exactly one public key by kid; reject unknown and retired keys before Agent Runtime execution.

Acceptance criteria

• JSON, SSE, cancellation, and nested calls continue through the existing Gateway -> Router -> Agent path during approved rotation.
• No automatic signer fallback, retry, alternate key lookup, dual signing, or implicit trust expansion exists.
• Partial rollout, stale restart, key-ID reuse, invalid signature, wrong audience, expiry, replay, and retired-key cases retain exact existing error categories.
• Rotation facts never enter Agent Card, Workspace, Invocation Result, or Invocation Ledger contracts.
• Focused unit, contract, integration, and race checks pass with no secret material in logs or errors.