Write a signing-key rotation runbook

[phertyameen]

Location

docs/deployment.md

Problem

Companion doc to the sweep signing key rotation issue (section D), this is the operator-facing runbook someone follows during an actual rotation, distinct from the engineering work of supporting rotation at all.

Acceptance Criteria

• Step-by-step runbook validated against an actual rotation performed in a non-production environment
• Includes rollback steps if a rotation goes wrong mid-process
• Linked from SECURITY.md given its security relevance