Key lifecycle across namespaces, part 2: rotate/revoke every namespace in one act; notice for a split state #105

Split from #104 (ruled 6 October). Part 1 (rulings 1 and 2: a key is bound once per namespace; a close ends the key in every namespace) is #104. This part lands after the Varve import (#73). Not implemented yet.

Scope

1. identity rotate and identity revoke act on every namespace the key is bound in, in one act. One change-set closes every open binding of that (principal, key), and each close is signed as its namespace's policy requires. Since ruling 2, a single close already ends the key everywhere, from its position. This makes the store say so: every binding carries its own close, so each namespace's history shows the key's end without a cross-namespace lookup.
2. A verify notice for a split state, if any state can still be split. This is a notice, not a finding, and no new class. Under ruling 2 a key cannot be live in one namespace and closed in another at the same position: the check treats it as closed everywhere. A state that can still be split is one where some bindings of a closed key have their own close and others don't, as stores filed before part 1 or hand-written ones do. The notice would name those bindings so the holder can close them explicitly. Whether that is worth a notice, or nothing remains to report once item 1 lands, is to be decided when this is picked up.

Depends on

• Key lifecycle across namespaces, part 1: a key is bound once per namespace; a close ends the key #104 (part 1).
• The Varve import, I12: ledger import --from docs/decisions/*.md (the interim set files) #73.