Take a rotated vault's contents onto the new key as well

Rotating a vault re-keyed the vault and not its contents, which was the deal
struck last time: everything already stored stayed sealed under the generation it
was written with, every remaining member kept the older keys, and the guarantee
was narrowed to "nothing written from now on". That left one gap worth closing —
somebody who walked off with the old key could still open old ciphertext they
later got hold of — and the reason it was safe to defer is the reason it was
cheap to add. A vault at mixed generations reads perfectly well, so the pass that
moves items across can stop half way and be run again.

VaultResealer walks the vault and rewrites each item as an ordinary upsert
against the version the server holds. It never decodes the plaintext: an item is
opened and the same bytes are sealed again under a fresh data key, so an item
written by a newer client crosses a rotation untouched rather than being
re-encoded through this build's codec and quietly losing the fields this build
has no concept of. It also means nothing in the pass knows what an item is, which
is why one loop covers every type including the ones added after it. A conflict
is counted and skipped rather than merged — there is nothing to merge, since no
content changes — and the next pass picks the item up at the version the other
client left.

The half that a pass over stored items cannot see is a change queued before the
rotation and pushed after it, which would put a brand-new item into the vault
under the key the person who just left still holds. So the push path re-seals a
stale payload as it dispatches it, writing the revision back to the outbox first
so that a retry sends the same bytes rather than a fresh envelope. Between the
two, nothing reaches the server under a superseded generation at all. Queued
items are therefore deliberately left alone by the pass: rewriting one there
would overwrite the user's unpushed work with the version the server holds, which
is the one thing a re-keying pass must never do.

Removal runs it last, after a sync — a mirror that is behind produces a batch of
conflicts instead of a re-sealed vault — and the status line distinguishes the two
guarantees, because they are not the same: a vault fully re-sealed is closed to
the person who left, and one with items outstanding is closed only to what
happens next.

Six tests, and three mutations run against them: making the re-seal return the
payload unchanged fails five of the six, making the push path skip re-sealing
fails the queued-edit test and only that one, and counting conflicts as applied
fails the write-elsewhere test. One of the six was wrong before it was right — it
modelled a third-party write by re-pushing an existing payload at a bumped
version, which no real client would do, and it took reading the AAD to see that
the test was lying rather than the code.

tests/DodoSSH.Client.Sync.Tests/SyncHarness.cs

@@ -1,3 +1,4 @@
+using System.Security.Cryptography;
 using DodoSSH.Client.Domain;
 using DodoSSH.Client.Storage;
 using DodoSSH.Crypto;
@@ -16,6 +17,9 @@ internal sealed class SyncDevice : IDisposable
     private readonly ClientCacheFactory factory;
     private readonly LocalCacheProtector protector;
 
+    private readonly FakeVaultServer server;
+    private readonly SyncOptions options;
+
     private SyncDevice(
         string name,
         ClientCacheFactory factory,
@@ -27,6 +31,8 @@ internal sealed class SyncDevice : IDisposable
         Name = name;
         this.factory = factory;
         this.protector = protector;
+        this.server = server;
+        this.options = options;
         Keyring = keyring;
 
         Items = new ItemStore(factory, protector);
@@ -96,6 +102,15 @@ internal sealed class SyncDevice : IDisposable
     internal Task<SyncReport> SyncAsync() =>
         Engine.SyncAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
 
+    /// <summary>Moves everything this machine can see onto the vault's current key.</summary>
+    /// <remarks>
+    /// Built per call rather than held, as the engine is: it carries no state between passes, and one
+    /// per call is what the session does.
+    /// </remarks>
+    internal Task<ResealReport> ResealAsync() =>
+        new VaultResealer(server, Items, Outbox, Keyring, TimeProvider.System, options)
+            .ResealAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
+
     internal Task<ItemListing<HostSecret>> ListAsync() =>
         Hosts.ListAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
 
@@ -274,6 +289,41 @@ internal sealed class SyncHarness : IDisposable
         }
     }
 
+    /// <summary>
+    /// Rotates the vault: a new key, taken by both machines, and a server that says so.
+    /// </summary>
+    /// <returns>The key the vault has just moved off, so a test can prove it no longer opens anything.</returns>
+    /// <remarks>
+    /// <para>
+    /// Stands in for the server call the real rotation makes. What matters here is the state it leaves —
+    /// a vault whose current generation is one past everything stored in it — and the grant round trip
+    /// that produces that state is <c>DodoSSH.Api.Tests</c>'s subject, not this suite's.
+    /// </para>
+    /// <para>
+    /// Each keyring gets its own copy of the bytes, because a keyring owns what it is handed and zeroes
+    /// it on disposal; sharing one array would leave the second machine holding a zeroed key at the end
+    /// of a test and produce failures that look like a decryption bug.
+    /// </para>
+    /// </remarks>
+    internal byte[] Rotate()
+    {
+        var generation = Server.KeyGeneration + 1;
+
+        First.Keyring.TryGetAt(VaultId, Server.KeyGeneration, out var previous).ShouldBeTrue();
+
+        var superseded = previous.ToArray();
+        var key = VaultKeys.Create();
+
+        First.Keyring.Adopt(VaultId, [.. key], generation);
+        Second.Keyring.Adopt(VaultId, [.. key], generation);
+
+        CryptographicOperations.ZeroMemory(key);
+
+        Server.KeyGeneration = generation;
+
+        return superseded;
+    }
+
     /// <summary>Brings both devices up to date, twice, so the result is a settled state.</summary>
     /// <remarks>
     /// Twice because one pass per device is not enough for a change made on one to be merged on the