Secrets rotation tool should check for the RotationComplete tag in primary state

To accommodate recovery from failed rotation, the plan should not consider a rotation as current/unexpired if the secret doesn't have a RotationComplete=true tag

Inspect the secrets rotation tool's plan logic, focusing on how primary state determines whether a rotation is current or unexpired. Verify the behavior against recovery from failed rotation and the RotationComplete=true tag; done means rotations without that tag are not treated as current or unexpired.

Written by the indexing model from the issue text.