Rotate a production secret in the vault

Practice the secret-rotation runbook from platform-security training. The old secret is not revoked until every consumer has the new value and a health check.

1. Generate the new secret in the vault; do not paste it into chat.
2. Deploy the new value to a staging consumer and verify.
3. Roll production consumers to dual-accept old and new if the app allows it.
4. Switch production to the new secret only.
5. Confirm health checks and logins succeed.
6. Revoke the old secret last.
7. Record the change.