Separate agent and admin cluster credentials after the 2026-09-23 key-cape exposure, reject last-applied annotations by admission policy, and record the deferred rotation with its triggers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
