Retire the rekey Docker suites; timing, continuity and variants are in-process

The three rekey integration suites (rekey, rekey-accept-off,
rekey-outbound-only) are dropped from both runners. Their coverage now
lives in fast, deterministic in-process tests:

- rekey timing and choreography (trigger, K-bit cutover, drain, jitter,
  guards) in the sans-IO poll_rekey tests (proto/fsp, proto/fmp);
- data-plane continuity across a real cutover in
  rekey_cutover_preserves_data_plane (a real IK rekey over loopback);
- the accept-off dual-init regression and the udp.outbound_only rekey
  loop in the should_admit_msg1 and dual-init characterization tests.

Drop them from both runners in lockstep so the parity guard stays green,
and record the retirement in the deliberately-not-run block with a pointer
to the standalone runner. The rekey-test.sh script stays on disk.

.github/workflows/ci.yml

@@ -414,16 +414,6 @@ jobs:
           - suite: static-chain
             type: static
             topology: chain
-          # ── Rekey integration test ──────────────────────────────────────────
-          - suite: rekey
-            type: rekey
-            topology: rekey
-          - suite: rekey-accept-off
-            type: rekey-accept-off
-            topology: rekey-accept-off
-          - suite: rekey-outbound-only
-            type: rekey-outbound-only
-            topology: rekey-outbound-only
           # ── Firewall baseline (fips0 nftables default-deny) ────────────
           - suite: firewall
             type: firewall
@@ -563,105 +553,6 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile ${{ matrix.topology }} down --volumes --remove-orphans
 
-      # ── Rekey integration test ──────────────────────────────────────────────
-      - name: Generate and inject configs (rekey)
-        if: matrix.type == 'rekey'
-        run: |
-          bash testing/static/scripts/generate-configs.sh rekey
-          bash testing/static/scripts/rekey-test.sh inject-config
-
-      - name: Start containers (rekey)
-        if: matrix.type == 'rekey'
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey up -d
-
-      - name: Run rekey test
-        if: matrix.type == 'rekey'
-        run: bash testing/static/scripts/rekey-test.sh
-
-      - name: Collect logs on failure (rekey)
-        if: matrix.type == 'rekey' && failure()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey logs --no-color
-
-      - name: Stop containers (rekey)
-        if: matrix.type == 'rekey' && always()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey down --volumes --remove-orphans
-
-      # ── Rekey + accept_connections=false variant ──────────────────────────
-      - name: Generate and inject configs (rekey-accept-off)
-        if: matrix.type == 'rekey-accept-off'
-        env:
-          REKEY_TOPOLOGY: rekey-accept-off
-          REKEY_ACCEPT_OFF_NODES: b
-        run: |
-          bash testing/static/scripts/generate-configs.sh rekey-accept-off
-          bash testing/static/scripts/rekey-test.sh inject-config
-
-      - name: Start containers (rekey-accept-off)
-        if: matrix.type == 'rekey-accept-off'
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-accept-off up -d
-
-      - name: Run rekey test (accept-off variant)
-        if: matrix.type == 'rekey-accept-off'
-        env:
-          REKEY_TOPOLOGY: rekey-accept-off
-          REKEY_ACCEPT_OFF_NODES: b
-        run: bash testing/static/scripts/rekey-test.sh
-
-      - name: Collect logs on failure (rekey-accept-off)
-        if: matrix.type == 'rekey-accept-off' && failure()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-accept-off logs --no-color | tail -300
-
-      - name: Stop containers (rekey-accept-off)
-        if: matrix.type == 'rekey-accept-off' && always()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-accept-off down --volumes --remove-orphans
-
-      # ── Rekey + udp.outbound_only=true variant ─────────────────────────────
-      - name: Generate and inject configs (rekey-outbound-only)
-        if: matrix.type == 'rekey-outbound-only'
-        env:
-          REKEY_TOPOLOGY: rekey-outbound-only
-          REKEY_OUTBOUND_ONLY_NODES: b
-        run: |
-          bash testing/static/scripts/generate-configs.sh rekey-outbound-only
-          bash testing/static/scripts/rekey-test.sh inject-config
-
-      - name: Start containers (rekey-outbound-only)
-        if: matrix.type == 'rekey-outbound-only'
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-outbound-only up -d
-
-      - name: Run rekey test (outbound-only variant)
-        if: matrix.type == 'rekey-outbound-only'
-        env:
-          REKEY_TOPOLOGY: rekey-outbound-only
-          REKEY_OUTBOUND_ONLY_NODES: b
-        run: bash testing/static/scripts/rekey-test.sh
-
-      - name: Collect logs on failure (rekey-outbound-only)
-        if: matrix.type == 'rekey-outbound-only' && failure()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-outbound-only logs --no-color | tail -300
-
-      - name: Stop containers (rekey-outbound-only)
-        if: matrix.type == 'rekey-outbound-only' && always()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile rekey-outbound-only down --volumes --remove-orphans
-
       # ── Firewall baseline integration test ─────────────────────────────────
       - name: Run firewall baseline integration test
         if: matrix.type == 'firewall'