Alias: rotate. No flags beyond the globals. Generates fresh TLS credentials
and an auth token for the environment, writes them to the guest’s credential
files, and persists the orchestrator’s new encrypted copy. The environment
keeps running throughout.
fuse environment rotate-token fuse-abc123# rotated token for environment "fuse-abc123"
Rotation only works on a running environment, and the orchestrator must have
been started with a 32-byte hex TOKEN_ENCRYPTION_KEY. Neither precondition
wraps a sentinel error, so both surface as HTTP 500 rather than a 4xx.