An operator key, a second seal on every own secret, and the vault keeps the export

novox/hq ADR 0085, amended: the mesh's root secrets — the store's superuser,
the broker's administrator, every secret a module holds for itself — were
sealed to a node key and nothing else, so a lost node took them with it.
Now the mesh records an operator's public sealing key and seals every own
secret to it as well, minted or accepted. The private half is written once
by `operator key new` to a file the operator keeps off the mesh; the mesh
holds one more blob per secret that it cannot open.

`secret recover` opens a secret with that key, to a 0600 file, from the
store or from an export; `secret export` writes every operator-sealed copy
as ciphertext. A module that `keeps` (the vault) is handed that export as a
declared file on its own disk, so recovery survives the store.

Secrets made before the key exists have no operator copy and are said so —
the plaintext was discarded — until each is issued again.

cmd/mesh-controller/main.go

@@ -100,6 +100,8 @@ func run() error {
 		return settingsCommand(ctx, args[1:])
 	case "secret":
 		return secretCommand(ctx, args[1:])
+	case "operator":
+		return operatorCommand(ctx, args[1:])
 	case "plan":
 		return planCommand(ctx, args[1:])
 	case "push":
@@ -155,6 +157,12 @@ func usage() {
   settings clear <module> [--node <n>]      take a layer away
   secret accept <node> <module> <name>     carry a value the mesh did not make and cannot invent
   secret accept ... --from <file>           ...read it from a file rather than being asked
+  secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>]
+                                            break-glass: open the operator-sealed copy, to a 0600 file
+  secret export [--out <file>]              every operator-sealed copy, ciphertext — keep it with the key
+  operator key make [--out <file>]          make the operator's sealing key, off the mesh; private half to the file only
+  operator key set <public> [--replace]     tell the mesh which operator key to seal to
+  operator key show                         the operator key, and what it can recover
   build <repository> [--ref R]   have a build machine build it, and record what came out
   build --behind                 build every module the mesh holds older than its source
   builds [<module>]              what has been built lately, and what came of it