SSE stream for credential rotation events

Runtime-worker-JWT-only Server-Sent Events endpoint. Requires `worker:session`. Before any credential read or subscription, the platform resolves the canonical secret-release scope from the active worker row and claimed session: JWT worker (`sub`), org, and project claims must exactly match the active worker; the session must be owned by that worker in the same org/project scope. Missing or mismatched ownership is collapsed to 404. The stream fails closed: authentication, canonical scope resolution, credential-gate evaluation, initial snapshot materialization/filtering, and rotation subscription registration all complete before `text/event-stream` is returned. It emits `INITIAL`, then filtered `UPDATE` events when an upstream OAuth rotation occurs, plus heartbeat events. Dependency failures return 503 instead of opening a partial stream.

curl -X GET "https://example.com/api/daemon/credentials/rotate-stream?sessionId=string"

"string"

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}