Rotate Cosign Key Pair

Backed up old private key to <DIR>/cosign.key.<TIMESTAMP>

Backed up old public key to <DIR>/cosign.pub.<TIMESTAMP>

✓ Generated new key pair

→ No artifacts specified — re-sign manually with: cfgd module push --sign --key cosign.key ...

✓ Key rotation complete
