Function apply_key_rotation 

pub fn apply_key_rotation(
    new_key: [u8; 32],
    key_service: &KeyService,
    encryption_lock: &RwLock<EncryptionService>,
) -> Result<String, MembershipOpsError>

Apply the effects of a member removal: update keyring, config, and encryption service. Rotate the in-use encryption key: persist it to the keyring and swap the live encryption service. Returns the new key’s fingerprint for the host to record in its own config — coven never writes the host’s config.