feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger

① Key management (B3/KMS): vault-kms.sh gains `rotate` (Transit key rotation)
  and `assert-nonexportable` (proves private material never leaves the KMS).
  Validated live against a Vault dev server: sign→verify (v1) → rotate →
  sign→verify (v2) → export denied. sign-audit-head.sh already routes to Vault
  when VAULT_ADDR/TOKEN are set, so this is the real production signing path.
② External WORM audit (C5/V21): worm-ledger.py + audit-ship.sh append the audit
  head to a hash-linked append-only ledger (chattr +a best-effort on Linux;
  S3 Object Lock/QLDB in production). verify-audit-gap.sh detects local audit
  rollback (AUDIT_GAP_DETECTED — the durable ledger still holds the later head)
  and ledger tampering (AUDIT_LEDGER_TAMPERED).
phase-h5-infra-tests.sh: 7 checks — KMS sign/rotate/non-exportable (skip-aware,
  live when Vault reachable) + WORM in-sync/rollback/tamper (always local).

Baselines: run-casan4 35/35, adversarial 44/44, approval 8/8. Lifts H5
key-mgmt 2.5→~4 (KMS live path + rotation + non-exportable) and external-audit
1.5→~3.5 (WORM ledger + gap detection). Suites now 7 (+7 = 155 checks).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh

@@ -156,6 +156,36 @@ vault_kms_enable_transit() {
     "$VAULT_ADDR/v1/sys/mounts/transit" >/dev/null 2>&1 || true
 }
 
+# ── Rotate a transit key (new version; old versions retained) ──────────────
+# Key rotation is a core KMS/HSM property: sign future heads with a fresh key
+# version without exporting or exposing any private material.
+vault_kms_rotate() {
+  local key="${1:-$_VAULT_AUDIT_KEY}"
+  _check_deps
+  vault_kms_ensure_key "$key"
+  curl -sf -X POST \
+    -H "X-Vault-Token: $VAULT_TOKEN" \
+    "$VAULT_ADDR/v1/transit/keys/$key/rotate" >/dev/null 2>&1 || {
+      echo "vault-kms: rotate failed (key=$key)" >&2; return 1; }
+  local ver
+  ver=$(curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/transit/keys/$key" \
+    | python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('latest_version','?'))" 2>/dev/null || echo "?")
+  echo "VAULT_KMS_ROTATED key=$key latest_version=$ver"
+}
+
+# ── Prove non-exportability: an export attempt MUST fail for a KMS key ──────
+# Returns 0 if the key is NON-exportable (export denied) — the desired state.
+vault_kms_assert_nonexportable() {
+  local key="${1:-$_VAULT_AUDIT_KEY}"
+  if curl -sf -H "X-Vault-Token: $VAULT_TOKEN" \
+       "$VAULT_ADDR/v1/transit/export/signing-key/$key" >/dev/null 2>&1; then
+    echo "VAULT_KMS_KEY_EXPORTABLE key=$key (INSECURE — key material can leave KMS)" >&2
+    return 1
+  fi
+  echo "VAULT_KMS_KEY_NONEXPORTABLE key=$key (private material never leaves KMS)"
+  return 0
+}
+
 # ── CLI entrypoint ────────────────────────────────────────────────────────
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
   CMD="${1:-status}"
@@ -167,8 +197,10 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     status)  vault_kms_status ;;
     enable-transit) vault_kms_enable_transit ;;
     ensure-key)     vault_kms_ensure_key "${1:-}" ;;
+    rotate)         vault_kms_rotate "${1:-}" ;;
+    assert-nonexportable) vault_kms_assert_nonexportable "${1:-}" ;;
     *)
-      echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key}" >&2
+      echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key|rotate|assert-nonexportable}" >&2
       exit 64
       ;;
   esac