docs(skills): state the rotation window and consumer contract in formae-generators

[JeroenSoeters]

Summary

Stacked on #41. Rotation now propagates to the resources that consume a rotated credential by reference (formae 0.89.0), so the skill's "the consuming side does not follow" warning described a gap that no longer exists on current agents. This replaces it with the contract that remains and cannot be removed by ordering:

• the window: no transaction spans the secret store and the authenticating system, so the two briefly disagree on every rotation, and only overlapping validity (alternating users, not built) removes it;
• the consumer contract to state out loud: re-read the credential at least once per rotation period, and tolerate transient authentication failures around a rotation for up to the consumer's own cache lifetime, with the agent's passwordSecretArn per-connection resolution as the worked example;
• cadence reality: AWS Secrets Manager retains 24 hours of versions against a non-adjustable 100-version quota and advises at most one sustained write per 10 minutes, so the one-minute schema floor is a drill setting, not a steady state;
• the drift refusal now sees drifted consumers as well as destinations.

CHANGELOG's Unreleased entry for the skill updated to match.