engineccl: pipeline registry rotation

Today, when encryption-at-rest decides it needs to rotate the encryption-at-rest registry, it blocks all incoming mutations during the rotation. With a large store, building and writing out the the new registry file can take non-negligible time. If ill-timed, this can block WAL rotation, blocking all user writes (and reads of new files too due to #98051).

When we decide we need to rotate the registry, we could asynchronously begin writing the snapshotted state to the new file. New mutations after the snapshot is taken are buffered. Once complete, we flush the queued mutations to the new file and atomically switch over. The mutex is only blocked during the moment of the switchover.

Jira issue: CRDB-36033

Start by locating the engineccl encryption-at-rest registry rotation implementation and tracing how mutations and WAL rotation interact with it. Done means registry snapshots can be written asynchronously, post-snapshot mutations are buffered and flushed, and the mutex is held only for the atomic switchover without blocking normal reads and writes.

Written by the indexing model from the issue text.