[hamzakargin]

• keys::Ring per core: lazy single-flight Open, bounded clock cache of working keys, call deadlines (short for open and unwrap, long for vault writes), reconnect with backoff, Hello on every connect; a changed naming key fails the ring and clears its cache.
• A timed-out call drops the connection only when a Hello probe also fails.
• Client::close shuts the stream down; a dropped client closes its connection.
• sched::Keyring adapts the ring to KeySource.
• KeyError::Failed: a failed ring or vault fails start instead of waiting.
• Queue load skips records whose header does not match their tenant or shard before asking for keys.
• Queue naming reports key failures as Refusal::Keys and counts them apart.

Part of #129