Pins a single sealing key (--key-renew-period=0). Upstream rotates every 30d and
kubeseal seals with the newest key, which would silently invalidate the off-cluster
key backup for secrets sealed after a rotation. Includes DR runbook.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Alex