A module's own secret rotates when its definition says the module reads it at start (hq 180)

`secret rotate <node> <module> <name>` makes the secret anew the way the first mint did, seals it
to the machine and the operator, and sends the machine, so the module starts again on the new value
— said in the log with who asked and when, never the value. Only for a secret whose definition says
`"taken": "at-start"`: an own secret is now a path, or {path, taken}, and a definition that says
nothing of how a secret is taken is refused with the word to write, because a credential rotated
under software that never reads it again is worse than one left alone (issue 179). `applied` is
refused by name until the staged form ADR 0114 decided is built; a value given to the mesh is
refused as ADR 0113 says. `rotate` is a verb on the controller's seat with two shapes — a pair
credential by provision, an own secret by machine, module and name — so the console can ask.
Registered manifests keep their bytes: a path alone is written back as a path.

internal/catalogue/verbs.go

@@ -99,6 +99,17 @@ var ControllerVerbs = []Verb{
 		Input: schema(map[string]string{"node": "the machine's name", "module": "the module's name"}, []string{"node", "module"})},
 	{Name: "push", Description: "Send a machine everything it should be — or every machine that is behind, when no machine is named.",
 		Input: schema(map[string]string{"node": "the machine's name; every machine behind when absent"}, nil)},
+	{Name: "rotate", Description: "Replace a credential. A pair credential, by provision (and a consuming machine, " +
+		"else every holder): both ends are re-sent together. Or a module's own secret, by machine, module and " +
+		"name: made anew and the machine sent, so the module starts again on it — only for a secret its " +
+		"definition says it reads at start; a value given to the mesh, or one the module applies to a backend, is refused with the reason.",
+		Input: schema(map[string]string{
+			"provision": "a pair credential: the provision whose credential to replace",
+			"consumer":  "with provision: only the holder on this machine (optional)",
+			"node":      "an own secret: the machine",
+			"module":    "an own secret: the module",
+			"secret":    "an own secret: its name in the module's definition",
+		}, nil)},
 	{Name: "build", Description: "Have the build machine build a repository. Answers at once with the build's id: " +
 		"`builds` with that id follows it line by line, and the module is registered when the outcome comes.",
 		Input: schema(map[string]string{