Establishes the deployment key-protection backend's first credential, rotates it to a supplied candidate, or restores the credential the last rotation superseded. Exactly one of credential and restorePrevious.

The value is WRITE-ONLY. It is never returned, never logged at any level, never audited, and never echoed on a read — the status read answers credentialPresent as a boolean and nothing more. It is sealed through the platform's own Plane-2 secret custody at the ROOT scope; it is never written to an environment file, never placed on a command line, and never turned into a container secret.

Nothing is promoted before it is proved. The candidate is sealed to a transient reference and a wrap/unwrap round trip is run against it first. A rotation and a restore run the round trip cross-credential — wrapping under the credential in effect and unwrapping under the candidate — so a candidate that reaches a different key-encryption key cannot be promoted. A restore takes the same path: the credential it puts back worked against the state the backend was in before the rotation, which is exactly what may have changed.

Phase TWO of a three-step surface: configuration, then credential, then activate. A credential submitted before any configuration is a 409 and seals nothing — a sealed value with no descriptor to own it is a secret nothing references, nothing evicts and nothing deletes.

On success the change is announced on the platform-settings channel so a running consumer drops its cached plaintext and re-resolves within seconds rather than within the cache TTL. The credential does not ride that channel: what travels is the key that names it.

ROOT-only. Requires platform.bootstrap AND admin.platform.deployment-secret.write.