Agent key rotation in place (today: key shown once, rotation = delete-and-recreate)

An agent's private key is shown once at creation, and there is no rotation path: replacing a compromised (or simply lost) key means delete-and-recreate. That loses more than the key — NIP-AE engrams are keyed to the agent identity, channel membership is per-pubkey, and message history attribution breaks.

**Proposal:** `buzz agents rotate-key ` that mints a new keypair for the same managed-agent record, with:

- a kind:30177 head published for the new pubkey carrying a `rotated_from` link to the old one,
- a migration path for `mem/*` engrams (re-encryption to the new conversation key, or a documented export/import),
- the old key's records tombstoned via NIP-09.

The open design question is how relays and other clients should treat the continuity link (is `rotated_from` advisory, or should relays serve the old coordinate's readers a redirect?). Filing as a design issue rather than a PR for that reason — we'd happily implement once the shape is agreed.

Context: we operate a ~20-agent fleet via the CLI and hit this while building fleet tooling; today our only answer to "rotate this agent's key" is delete-and-recreate plus manual engram export/import.

🤖 Generated with [Claude Code](https://claude.com/claude-code)