Add one-command owner envelope renewal (REINAH-WP-0008-T03)

owner renew validates a settled ledger, builds the new spend policy from an
envelope file of changed fields only, retires the old ledger by rename,
initializes a fresh one at the same path and rewrites the policy and
owner.json pins. Dry run by default; prints the Secrets Engine file pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 269692@bnt-lap001
Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be

docs/owner-bootstrap.md

@@ -23,6 +23,30 @@ first line of each launcher; the rehearsal executes them. Run 6efa9436
 
     python -I -B -m rein_aharness.cli metered-once --owner-config /abs/owner.json --rehearse
 
+**Renew an envelope with one command.** After the old envelope is
+reconciled (no `held` reservation, no open request route), write a small
+JSON file with only the fields that change: `envelope_id` (required and new),
+plus any of `authority_ref`, `valid_from`, `expires_at`, `eur_per_usd`,
+`per_run_eur`, `daily_eur`, `total_eur`, `max_budget_usd` and
+`max_liability_usd`. Then:
+
+    python -I -B -m rein_aharness.cli owner renew --owner-config /abs/owner.json \
+      --policy /abs/spend-policy.json --ledger /abs/spend.sqlite3 \
+      --runtime-path /abs/runtimes/<digest> --envelope envelope.json
+
+Without `--apply` this only prints the summary: envelope, policy and runtime
+digests from old to new, the limits, and where the old ledger goes. With
+`--apply` it:
+
+- backs up `owner.json` and the policy as `<name>.<old envelope>.bak`;
+- renames the old ledger to `<ledger>.retired-<old envelope>`;
+- initializes a fresh ledger at the same path;
+- writes the new policy and `owner.json` privately and atomically.
+
+No digest is typed by hand. Paths do not change, so the Secrets Engine
+`exec_owner` catalog needs only the new file hashes, which are printed as
+`catalog_file_pins`. Update those pins, then run `--rehearse`.
+
 Use the standalone candidate interpreter as `python -I -B -m rein_aharness.cli`.
 `-I` excludes editable PYTHONPATH/user-site fallbacks; `-B` prevents bytecode writes
 from changing the complete artifact digest. The source and namespace rein commands