resumeStorageKeyRotation

Advances a storage key rotation by one step and returns the new status:

• StorageKeyRotationPhase.PREPARING: finishes the start like rotateStorageKey.

• StorageKeyRotationPhase.MIGRATING: re-encrypts up to maxRecords records of the retiring key with the current key, in one transaction. When none are left, proves by a scan of every sealed record that no record uses the retiring key, then retires it.

• StorageKeyRotationPhase.RETIRING: removes the retiring key from the provider (again) and ends the rotation.

• StorageKeyRotationPhase.STABLE: nothing to do.

Call it until the phase is StorageKeyRotationPhase.STABLE. Every committed step survives a crash or cancellation; a failed step rolls back only itself. A record that does not open stops the migration: the rotation stays in progress and the retiring key is kept.