fix: preserve encrypted cache during key rotation

[dollarop]

Closes #173

Summary

• Preserve previously encrypted offline cache during key rotation.
• Re-encrypt the existing gp1: envelope before committing the new key.
• Defer key rotation if cache migration fails so old cache data is not silently lost.

Validation

• git diff --check passes.
• Conflict-marker scan passes.
• npm test / npm run lint could not run locally because dependencies are not installable in the current checkout due peer conflicts and disk constraints.