The engine test-dials, switches, confirms, drops and falls back across a rotation of its login

On node-logins' ready the engine fetches the new value through the vault's own hand-out (own/<node>/mesh-host/<login>, opened
with its sealing key), dials a second connection as the new login on the pinned certificate, and switches only if that
authenticates, then calls mesh-vault.node-account-confirm over the link as the new login (the vault is asked in the name of
the login the open link authenticated as, and only once that link is open). It keeps the old value until the key says the
rotation is done and drops it then, never before; an abandon, after the switch before or after the confirmation, switches
back before the new value is dropped; repeated refusals of the new login's credentials before rotation-done bring it back
to the old one, said as the finding node-account-fallback (in the journal: no route for an engine's finding to the watchman
is decided), and the same rotation is not tried again. Tests: two added, paid by merging two identity sealing tests into one;
more to be paid by deleting the identity token tests that move to mesh-sdk with the token (774/S64).

(issue 774, 774/S62, 774/S63)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/identity/identity_test.go

@@ -350,7 +350,8 @@ func TestASealingKeyOpensOnlyWhatWasSealedToIt(t *testing.T) {
 	}
 }
 
-func TestSealingTheSameValueTwiceLooksDifferent(t *testing.T) {
+// Sealing is randomised and a node with no sealing key is told what to do (two tests merged).
+func TestSealingIsRandomisedAndANodeWithNoSealingKeySaysWhatToDo(t *testing.T) {
 	// Sealed boxes are randomised, so an observer cannot tell that two nodes were given the same
 	// password, nor that a rotation changed nothing. Worth asserting because the alternative is
 	// a subtle leak nobody would look for.
@@ -360,9 +361,6 @@ func TestSealingTheSameValueTwiceLooksDifferent(t *testing.T) {
 	if first == second {
 		t.Fatal("sealing is deterministic, so equal secrets are visible as equal blobs")
 	}
-}
-
-func TestANodeWithNoSealingKeySaysWhatToDo(t *testing.T) {
 	// Rather than making one. A key the mesh was never told about is a key nothing can be sealed
 	// to, so a node that quietly created one would look fine and receive nothing for ever.
 	_, err := LoadSealingKey(t.TempDir() + "/absent.key")