Take accept, secret-ask, issued and rotate into the vault (issue 675)

ADR 0349 clauses 8 to 10: a value given at the controller's terminal, typed
at a desk or issued by a provider's software enters the vault and opens
there alone, and rotation is the vault's. Each comes in two steps from the
controller, which reaches the desk and the provider: the vault makes a key
for the one call and opens what was sealed to it. An ask is recorded in the
vault's store before the prompt opens and bounded to one open per secret
and three an hour.

Also V1's review follow-ups: the tool layer passes an act through, a
rolled record is said, the export's fingerprint and vault_status are
tested, and an unproven by is kept beside the proven caller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/mesh-vault/module.json

@@ -112,6 +112,7 @@
     "secret_holders",
     "secret_verify",
     "secret_handed",
+    "secret_asks",
     "secret_vault_export",
     "provisioner_retirement",
     "provisioner_retire_approve",
@@ -124,7 +125,11 @@
       "name": "mesh-vault",
       "scope": "mesh",
       "serves": [
-        "get"
+        "get",
+        "accept",
+        "secret-ask",
+        "issued",
+        "rotate"
       ]
     }
   ]