[Task]: Tenant-initiated credential rotation

Description

Carried over from #292 where criteria 5 and 6 were deliberately deferred.

Credentials never expire because nothing can refresh a Secret a tenant copied onto another cluster. That is the right default and it leaves no way to respond to a leak. Today the only remedy is deleting the Registry, which destroys the images too.

Acceptance criteria

1. Setting the annotation registry.opencloud.wso2.com/rotate to a new value mints a new robot and writes it into the Secret.
2. The previous robot stays valid for a grace period default 7 days. So copies can be updated before anything breaks.
3. status shows when the old credential will be revoked.
4. Revocation happens without a further reconcile trigger.
5. Rotation and revocation each emit an Event.

Verification

Annotate confirm the Secret changed and both credentials work. After the grace period the old one is refused and the new one still works.

Start by locating the Registry reconcile path and the Secret handling for robot credentials. Trace how status and Events are currently updated, then verify annotation-driven rotation, grace-period revocation without another reconcile trigger, and both credentials during the grace period.