audit-core-senders: rotation guidance pointing at audit-core's overlap-first procedure

Promotion criterion 9 (catalog_rotation_coverage) caught the missing block on
activation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

registry/routing/catalog.yaml

@@ -1359,6 +1359,14 @@ entries:
     exec_capable: false
     resolvable: false
     lane: secret
+    rotation:
+      method: rotate
+      owner: audit-core
+      automatable: false
+      steps:
+        - "Overlap-first per audit-core/docs/operator-runbook.md#sender-credential-rotation: add the replacement token to the sender's tokens list, move the sender to it, then drop the predecessor."
+        - "Write the updated registry back to platform/workloads/audit-core/senders from a mode-0600 file (never a founder paste, never argv); force the ExternalSecret sync or wait for the 1h refresh, then restart audit-core."
+        - "Senders with an exact-path projection (tenant-engine) are re-seeded through their own projection lane; verify by metadata and capabilities only."
 
   - id: email-connect-transactional
     title: email-connect transactional SMTP and caller ingest token