Prove bounded Kubernetes API-key rotation and rollback

[RicheyWorks]

Outcome

• add a shared constant-time verifier for the required primary API key and one bounded optional rotation key
• prove A-only -> A+B -> B-only rotation and reverse rollback with immutable versioned Kubernetes Secrets and zero-unavailable rollouts
• verify continuity, key retirement, pod UID turnover, fixed image identity, topology, backend distribution, evidence redaction, and zero container restarts
• bound the qualification fixture to a 32-thread/256-request executor with explicit JVM heap and stack caps after exact-head evidence exposed fixture OOM kills
• advance the live topology schema to 6 and reject unsafe profiles

Verification

• 31 focused API-key/security tests passed
• full Maven suite passed: 2,333 tests, 0 failures/errors/skips
• focused Kubernetes topology contract passed: 5 tests
• fixture source compiled with Java 17; shell syntax and Maven package passed
• pull-request and literal-head CI passed, including live two-zone Kubernetes rotation/rollback, planned and abrupt worker failure, zero container restarts, and all image scans
• CodeQL and dependency review passed
• one-hour soak passed: 72,000/72,000 requests across steady, reload, and drain phases; zero 5xx/errors; maximum p99 5.912 ms; approximately 3.0 MiB observed heap-floor growth against a 64 MiB budget