Function mark_revoked 

pub fn mark_revoked(vault: &mut Vault, keys: &[String], now: DateTime<Utc>)

Mark keys as owing a post-revoke rotation, stamping each with revoked_at.

Called when a recipient is revoked and rotation is deferred: the revoked recipient can still decrypt the live value from git history until it changes, so the obligation is recorded durably (and survives the user declining the rotation prompt). doctor surfaces it until a value write clears it. Keys without a schema entry are skipped — rotation_health only reads the schema, so an unschematized key could not be flagged anyway. now is injected to keep this testable and consistent with rotation_health.