Changing machinedeployment.spec.template.metadata.annotations doesn't result in rotation

### What steps did you take and what happened?

I changed the machinedeployment.spec.template.metadata.annotations with the CA secret hash.

### What did you expect to happen?

I expected the machines to rotate to load the new CA.

### Cluster API version

1.13.2

### Kubernetes version

1.34.1

### Anything else you would like to add?

I understand that labels are being dropped for rotation, but as normal k8s deployments rotate on annotation change, I assumed this would work as well.

I assume the same thing applies to machinePools. I know I can use rollout.after for machinedeployment, but what to use for machinePools?

Another solution would be that CAPI would rotate machines when the CA changes.

### Label(s) to be applied

/kind bug
One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels.

Start by tracing how MachineDeployment handles changes to spec.template.metadata.annotations and compare that behavior with rollout.after and MachinePool behavior. Check the relevant reconciliation and rollout tests, if present, and define done as a documented, tested answer for whether annotation changes trigger rotation and what equivalent MachinePool mechanism exists.

Written by the indexing model from the issue text.