Read-only ActivityPub → atproto bridge for the threadiverse using Coves lexicons

test(config): RED — the KEK-rotation acceptance contract master

Old-sealed material opens under (BRIDGE_KEK, BRIDGE_KEK_PREVIOUS); fresh seals open under the new KEK alone; with PREVIOUS unset the old blob fails — the negative control proving the test measures the second KEK. Two named stubs (BridgeKEKPrevious always-nil field, NewCustodianWithPrevious delegating to single-KEK) keep it compiling and failing on the assertion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>