fix(changeset): os secret rewrap declares Clause-② yes (widening)

The diff grows two published surfaces: a root export on
@objectstack/service-settings (ciphertextDerivationStatus and its type) and
the os secret rewrap command on @objectstack/cli. The levels (minor, minor)
already satisfy a widening declaration.

Claude-Session: https://claude.ai/code/session_01YDt3PzwfrkuFzUBF89WPmM
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21326-secret-rewrap.md

@@ -5,7 +5,7 @@
 
 feat(cli): `os secret rewrap` re-wraps version-1 `sys_secret` ciphertext under the current AAD derivation, each row under its holder's producer scope (ADR-0128 §4.2, #21326 stage 2)
 
-Clause-②: no
+Clause-②: yes (widening)
 
 A ciphertext sealed before ADR-0128 D1–D3 carries the older binding over
 `(namespace, key)` alone, and still opens in this release. `os secret rewrap` moves