[Agata-Proxima]

Summary

• Keep the pre-upgrade tenant verifier secret in process memory only during the compatibility window for existing one-hour tokens.
• Do not persist the legacy Control Plane master secret in the customer node identity JSON.
• Re-read the legacy secret from the existing environment or secret file on restart while the customer has not yet removed the old setting.

Validation

• Rust CI and tenant-isolation evidence required before merge.