Key rotation follow-ups from the PR #54 review #55

Items deferred from the review of #54 (key rotation in plain pull/push/diff behind features.key_rotation); none of them blocks the PR.

Behaviour

• Tenant push sends stale workspace dirs. A tenant push sends the key_rotation.yaml of every local workspaces/<wid>/ directory, including stale ones without server.yaml that the tenant import itself skips. Restrict it to workspaces present in the pushed configuration, or at least to dirs that have server.yaml. (internal/cac/keyrotation/dir_store.go DirStore.Workspaces, cmd/key_rotation_feature.go readKeyRotations)
• Plain pull drops starting_from. A plain pull rewrites the file from the server, which never echoes starting_from, so a locally set starting_from disappears on every routine pull. Consider preserving it on rewrite, or warn when dropping it. (internal/cac/keyrotation/sync.go Pull)
• merged diff side is not a per-use merge. The merged side picks the local file or the server per workspace, unlike the regular merged view, so a local file with only sig makes the remote enc show up as a spurious difference. Merge per use (fall back to the server for uses the local file does not set). (internal/cac/keyrotation/diff.go Side.Read)
• Stale --out file on an empty key-rotation-only dry run. Done in feat: handle key rotation in plain pull, push and diff behind features.key_rotation #54. A key-rotation-only push --dry-run with nothing to push leaves an existing --out file untouched, so a stale plan can look current. Truncate it or write an empty stream. (internal/cac/keyrotation/dry_run.go DryRun.WriteAll, cmd/key_rotation_feature.go pushKeyRotations)

Security hardening (low, same trust model as the existing config files)

• Cross-profile identity compared by name. Whether a diff side reuses the already-initialized client is decided by comparing the profile name, which users can set and which can collide. Compare the resolved profile key instead. (cmd/key_rotation_feature.go sideSpec.gate / sideSpec.side)
• key_rotation.yaml is rendered as a template. The file goes through the template engine (env, include), so a crafted cron can echo environment values into diff output, and over-long cron strings pass validation. Read the file without rendering and/or cap cron fields at 7. (internal/cac/keyrotation/dir_store.go DirStore.Read, internal/cac/keyrotation/keyrotation.go Config.Validate)
• Server-supplied workspace ids joined into paths unchecked. In a tenant pull, workspace ids returned by the server are joined into file paths without checks. Reject ids that are not a single local path segment. Pre-existing in internal/cac/storage/server_storage.go (ServerStorage.workspacePath) too. (internal/cac/keyrotation/dir_store.go DirStore.Write / DirStore.dirPath)

Simplification

• Drop the ignored-file warning on plain push. Done in feat: handle key rotation in plain pull, push and diff behind features.key_rotation #54. It fires for users who intentionally use only the key-rotation subcommands, and even with unrelated --filter values. Remove it along with DirStore.Has. (cmd/key_rotation_feature.go warnIgnoredKeyRotation, cmd/push.go, internal/cac/keyrotation/dir_store.go DirStore.Has)
• Trim indirection and duplication (~120 lines, no behaviour change). Done in feat: handle key rotation in plain pull, push and diff behind features.key_rotation #54, except the TestValidateConfiguration subtests (next item). Collapse the DryRun struct into a single function; drop Reader (type Side.Remote as Remote), NewService, the exported ReadLocal, and the unreachable newline guard in appendSection; remove duplicated subtests in TestValidateConfiguration; trim the README examples. (internal/cac/keyrotation/dry_run.go DryRun, internal/cac/keyrotation/service.go Reader / NewService / Service.ReadLocal, internal/cac/keyrotation/diff.go Side / appendSection, internal/cac/config/config_test.go TestValidateConfiguration, README "Managing key rotation")
• Duplicated subtests in TestValidateConfiguration. Left over from the item above. (internal/cac/config/config_test.go)
• Misleading test comment. Done in feat: handle key rotation in plain pull, push and diff behind features.key_rotation #54: the test went away with Service.Diff. A comment in the service diff test claims a NotFound case but the test injects a generic error. Fix the comment, or inject an actual NotFound error to cover what it describes. (internal/cac/keyrotation/service_test.go, the svc.Diff case)

Longer term: a dedicated manage_key_rotation scope on the server side so features.key_rotation no longer needs manage_servers.