#999 Tenant secret key rotation tooling: reload ring once on unknown key id; hwe secrets reseal

EARS: When the store reads an envelope whose key id is not in the cached key ring, it shall reload the ring once before failing. The system shall provide 'hwe secrets reseal [--key-id X]' that re-encrypts every tenant_secret_values row under the current key in batches, idempotently, and reports rows per key id; a key may be removed from the ring only when no row and no canary need it. FOUND in #924 review (M4). Today Config caches the ring for 5 minutes, so a ring rotated on the host (scripts/import_platform_secrets.py --init-store-key --new-ring) is picked up per process after up to 5 minutes, and old rows stay on the old key until rewritten.