S25: npe adapter matches real send/keygen CLI; config key rotate script

Probe reports usable without enabling PFC_REQUIRE_NPE. Fail-closed if
sender .seed or recipient .npeid is missing.

tests/test_sm.py

@@ -37,8 +37,12 @@ class NpeAdapterTests(unittest.TestCase):
     def test_npe_mode_fail_closed(self):
         from secure_messaging import NpeRequired
         from secure_messaging.envelope import seal
+        from secure_messaging.npe_adapter import probe
 
         self.assertTrue(hasattr(__import__("secure_messaging"), "NpeRequired"))
+        st = probe()
+        self.assertIn("usable", st)
+        # mode=npe never falls back to lab-xor (missing seed or missing binary).
         with self.assertRaises(NpeRequired):
             seal(to="npe.inbox.x", sender="alice", body={"a": 1}, mode="npe")