[samgbafa]

TC-887. Second PR of the refreshed at-rest stack (base: #513). Replaces #326.

What

• tinycloud-core/src/at_rest/{hierarchy,keyring,store}.rs, the at_rest_key / at_rest_escrow / space_data_key models and their migration, unchanged from feat(TC-887): at-rest keyring, key store and migration #326 at 9131d24 (reviewed and approved there).
• Rebase onto main:
  • The migration is renamed m20261107_000000_at_rest_keys and appended after main's newest migration (m20261026_000000), so the list stays in name order. It has never been released.
  • tinycloud-core gains lru, parking_lot and the escrow crate. The root, test/m1-realdata-e2e and test/w5-policy-runtime-node-e2e lockfiles are refreshed. The w5 lock also picks up main's current tinycloud-node version.
• New: AtRestKeyring::open_with_previous_root. If the stored ARK rows don't open under the current root but do open under the previous one, every generation is re-sealed under the current root, in the database and in the mirror, and the keys unlock.
  • Chains, DEK wraps and object names don't change. A root change therefore rewrites one row per generation and no data.
  • Rows that already open under the current root ignore the previous root. Rows that open under neither leave the keyring locked, as before.
  • Retirement markers made under the previous root still retire their ARK.
  • The node wiring (next PR) uses this for an operator-supplied root that changes.

Not here

• Nothing calls the keyring yet; the node wiring is the next PR.

Verification

• cargo test --locked -p tinycloud-core at_rest: all pass, including the new a_previous_root_reseals_every_generation_under_the_new_root and a_previous_root_that_opens_nothing_leaves_the_keys_locked.
• cargo clippy --locked -p tinycloud-core --all-targets with -Dwarnings, and cargo fmt --all -- --check: clean.
• The PostgreSQL migration and keyring tests run in CI.