The machine pairing vault borrows the GitHub vault's active key and cannot survive its rotation #192

What happened

#180's rehearsal 4 asks that rotating each key-like secret leave already-issued records readable. For the machine pairing vault it does not, and the coupling that causes it is not recorded in any document.

OpenAgents.Machines.TokenVault derives its key like this:

defp key do
  with encoded when is_binary(encoded) <-
         Application.get_env(:openagents, :github_token_encryption_key),
       {:ok, key} when byte_size(key) == 32 <- Base.decode64(encoded) do
    {:ok, key}
  else
    _missing -> {:error, :token_vault_not_configured}
  end
end

It reads the GitHub vault's active key. Its envelope carries a version byte and no key id, and it consults no github_token_decryption_keys keyring. OpenAgents.Accounts.TokenVault, by contrast, puts the key id inside the envelope, binds it into the AAD, and keeps up to sixteen prior keys so old envelopes still open.

So the documented GitHub key rotation in docs/github-auth-plan.md — add the old key to the keyring, activate the new one, rewrap with rotate_github_tokens!/0 — rewraps every GitHub token and, in the same step, makes every outstanding machine_pairings.token_ciphertext permanently unopenable. open/1 answers {:error, :token_unsealable} and the keyring cannot help, because key/0 never reads it.

OpenAgents.Voice.RecordingVault has the same shape with its own key: one key, no key id, no keyring, no rewrap path. test/openagents/voice/recordings_test.exs:319 already pins that a wrong key fails closed; what is missing is that nothing says rotating it is unrecoverable.

Blast radius, stated honestly

Bounded rather than absent. @pairing_lifetime_seconds is 600, and both terminal transitions null the ciphertext column — a claimed pairing at lib/openagents/machines.ex:395 and an expired one at :413. So a GitHub key rotation loses at most ten minutes of unclaimed pairings, and a person retries. The long-lived machine token is a bare sha256 digest with no key under it and is unaffected.

That bound is why this is a documentation and keyring defect rather than an incident. It is still a silent loss during a procedure whose written steps say nothing about it.

Acceptance criteria

• OpenAgents.Machines.TokenVault reads its own configured key rather than the GitHub vault's, or the sharing is deliberate and both docs/github-auth-plan.md and docs/security/secrets-and-log-handling.md state that rotating GITHUB_TOKEN_ENCRYPTION_KEY invalidates outstanding pairings.
• docs/forge-exit-rehearsals.md rehearsal 4 records which of the three vaults can be rotated without loss. Today the answer is one of three.
• A proof covers the coupling, so a future change to either vault's key source turns it red.

Found by: #180's rehearsal 4, docs/forge-exit-rehearsals.md.