rotate-genesis: replace the store's genesis grant #83

Source: Session A close-out §3 question 11 (docs/sessions/2026-10-session-a.md), ruled 2 October 2026: "No ruling; an issue for rotate-genesis." Reasoning: docs/signing-rulings-2026-10-d5-d9.md, "Session A close-out §3", row 11. Size: M. Depends on: PR #80 merged; #70 (signing, key bindings, D7). Must land: before any store other than the principal's own depends on the ledger.

Why

There is one genesis per store (question 3), policy changes are the genesis holder's act (question 6), and under D7 the genesis holder vouches for every principal's first key. The genesis holder is therefore a single point of failure. The capability rotate-genesis and the fallback limit no-genesis exist in the closed vocabulary (ledger-core/src/authority/role.rs Capability, ledger-core/src/authority/grant.rs Limit), but no act uses them: Act::withheld_by maps nothing to no-genesis.

What to build

• An act that replaces the live genesis grant with a new one: a new genesis grant whose supersedes names the old one, carrying a new external_ref (the new out-of-band mandate), filed by a holder whose role may rotate-genesis, and refused to a fallback carrying no-genesis.
• The new holder's acceptance of it, and their self-bound first key binding under the new mandate.
• A005 keeps holding: exactly one live genesis after the act. Today structure::grant_faults refuses supersedes on a genesis grant ("rotating the genesis is its own act"); this issue is that act.
• What happens to the old holder's key bindings and to the acts they vouched for (D6 ordering: acts before the rotation stand).

Open for the PR to state

• Who may rotate when the genesis holder is unavailable or lost: the genesis role's fallback-1 over * (basis fallback-of-genesis already exists for unavailability), or only the holder.
• Whether the rotation is itself signed under the policy in force before it, like a policy change.

Tests

• Rotation by the holder; by a fallback without no-genesis; refused to a fallback with no-genesis; refused to a role without rotate-genesis.
• A005 green after rotation; red if two genesis grants are left live.
• Acts landed before the rotation still verify.

Constraints

Format document and migration note in the same PR. No format change outside this list.