Function rewrap_passphrase_identity_custody 

pub fn rewrap_passphrase_identity_custody(
    store_dir: &StoreDir,
    old: Passphrase,
    new: &Passphrase,
) -> Result<(), KeyError>

Re-wrap a store’s passphrase-protected signing identity under a new passphrase — the identity half of a host’s “change passphrase”, the sibling of crate::custody::rewrap_passphrase_custody. The store’s identity.envelope is decrypted with old and re-sealed under new (fresh salt and nonce). Errors if nothing is established there (KeyError::Persistence) or if old is wrong (KeyError::Crypto), leaving the existing file untouched on either failure. After it returns, the identity is re-opened under new.